PT-2016-3149 · Imagemagick+3 · Imagemagick+3

Adam Mariš · Publicado 2016-08-25 · Atualizado 2017-08-22 · CVE-2016-7539

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7

Description The issue is related to a memory leak in the AcquireVirtualMemory component of ImageMagick, which can be exploited by remote attackers to cause a denial of service through memory consumption. The exact vectors used for the exploitation are not specified.

Recommendations For versions prior to 7, update to version 7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the AcquireVirtualMemory component to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2017-2096

BDU:2017-01781

CVE-2016-7539

DLA-731-1

DSA-3652-1

SUSE-SU-2016:2667-1

USN-3131-1

Produtos afetados

Alt Linux

Imagemagick

Suse

Ubuntu

Referências · 207

• https://github.com/ImageMagick/ImageMagick/commit/4e81ce8b07219c69a9aeccb0f7f7b927ca6db74c · Correção
• https://github.com/ImageMagick/ImageMagick/pull/75 · Nota
• https://bugzilla.suse.com/1000697 · Nota
• https://ubuntu.com/security/CVE-2016-7532 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7533 · Nota
• https://ubuntu.com/security/CVE-2014-9815 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7513 · Nota
• https://ubuntu.com/security/CVE-2014-9823 · Aviso do Fabricante
• https://bugzilla.suse.com/1000434 · Nota
• https://ubuntu.com/security/CVE-2016-7515 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9808 · Aviso do Fabricante
• https://bugzilla.suse.com/1000707 · Nota
• https://ubuntu.com/security/CVE-2015-8896 · Aviso do Fabricante
• https://bugzilla.suse.com/1000706 · Nota
• https://bugzilla.suse.com/1000709 · Nota