PT-2015-3276 · Imagemagick+5 · Imagemagick+5
Publicado
2015-10-13
·
Atualizado
2018-05-18
·
CVE-2015-8897
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 6.9.2-4
Description
The issue is related to a buffer overflow in the SpliceImage function of the ImageMagick console graphic editor. This can be exploited by a remote attacker using a specially crafted png file, potentially causing a denial of service (application crash).
Recommendations
For versions prior to 6.9.2-4, update to version 6.9.2-4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SpliceImage function until a patch is applied. Avoid using the function with untrusted or specially crafted png files to minimize the risk of exploitation.
Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Imagemagick
Red Hat
Suse
Ubuntu