PT-2015-7826 · Imagemagick+3 · Imagemagick+3

Martin Prpič · Publicado 2015-12-31 · Atualizado 2020-07-31 · CVE-2015-8900

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions 6.x through 7.x

Description The issue allows remote attackers to cause a denial of service, specifically an infinite loop, by using a crafted HDR file. This is related to the ReadHDRImage function in coders/hdr.c.

Recommendations For ImageMagick versions 6.x through 7.x, consider disabling the ReadHDRImage function as a temporary workaround until a patch is available. Restrict access to processing HDR files to minimize the risk of exploitation.

Exploit

Correção

DoS

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2016-1580

CVE-2015-8900

DLA-960-1

OPENSUSE-SU-2016_1748-1

OPENSUSE-SU-2016_1833-1

SUSE-SU-2016:1784-1

USN-3131-1

Produtos afetados

Alt Linux

Imagemagick

Suse

Ubuntu

Referências · 257

• 🔥 http://imagemagick.org/discourse-server/viewtopic.php?f=3&t=26929 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/97aa7d7cfd2027f6ba7ce42caf8b798541b9cdc6 · Correção
• https://bugzilla.suse.com/983234 · Nota
• https://ubuntu.com/security/CVE-2016-7532 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8895 · Nota
• https://ubuntu.com/security/CVE-2014-9815 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9823 · Aviso do Fabricante
• https://bugzilla.suse.com/984028 · Nota
• https://bugzilla.suse.com/983523 · Nota
• https://bugzilla.suse.com/983533 · Nota
• https://ubuntu.com/security/CVE-2016-7515 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9808 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8896 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8894 · Nota
• https://ubuntu.com/security/CVE-2014-9836 · Aviso do Fabricante