PT-2008-4553 · Graphicsmagick+1 · Graphicsmagick+1

Publicado

2008-07-10

·

Atualizado

2017-08-08

·

CVE-2008-3134

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions: GraphicsMagick versions prior to 1.2.4
Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, infinite loop, or memory consumption, via unspecified vectors in various decoder readers, including AVI, AVS, DCM, EPT, FITS, MTV, PALM, RLA, and TGA. Additionally, the GetImageCharacteristics function in magick/image.c is vulnerable when processing crafted PNG, JPEG, BMP, or TIFF files.
Recommendations: For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable decoder readers and the GetImageCharacteristics function until a patch is applied. Avoid processing crafted image files from untrusted sources until the issue is resolved.

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-3134
DSA-1903-1
ECHO-28C1-57BE-0BA4

Produtos afetados

Debian
Graphicsmagick