PT-2007-6100 · Imagemagick+1 · Imagemagick+1

Publicado

2007-09-24

·

Atualizado

2024-06-15

·

CVE-2007-4988

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.3.5-9
Description The issue is related to a sign extension error in the ReadDIBImage function, which allows context-dependent attackers to execute arbitrary code. This is achieved by providing a crafted width value in an image file, triggering an integer overflow and a heap-based buffer overflow.
Recommendations For versions prior to 6.3.5-9, update to version 6.3.5-9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ReadDIBImage function until a patch is applied. Avoid using crafted image files that could trigger the integer overflow and heap-based buffer overflow.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-681

Identificadores relacionados

CVE-2007-4988
DSA-1858-1
DSA-1903-1
DTSA-63-1
OPENSUSE-SU-2024:10596-1
RHSA-2008:0145
RHSA-2008_0145

Produtos afetados

Imagemagick
Red Hat