PT-2016-6644 · Imagemagick+3 · Imagemagick+3

Hanno Böck · Publicado 2016-06-05 · Atualizado 2016-12-16 · CVE-2016-5690

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.4-5 ImageMagick versions 7.x prior to 7.0.1-7

Description The issue concerns the ReadDCMImage function in the DCM reader of ImageMagick, allowing remote attackers to have an unspecified impact. This is achieved through vectors involving the for statement in computing the pixel scaling table.

Recommendations For ImageMagick versions prior to 6.9.4-5, update to version 6.9.4-5 or later. For ImageMagick versions 7.x prior to 7.0.1-7, update to version 7.0.1-7 or later.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2016-1580

CVE-2016-5690

DLA-731-1

DSA-3652-1

OPENSUSE-SU-2016_1748-1

OPENSUSE-SU-2016_1833-1

SUSE-SU-2016:1782-1

SUSE-SU-2016:1784-1

USN-3131-1

Produtos afetados

Alt Linux

Imagemagick

Suse

Ubuntu

Referências · 263

• 🔥 https://github.com/ImageMagick/ImageMagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d · Exploit
• https://github.com/ImageMagick/ImageMagick/blob/6.9.4-5/ChangeLog · Aviso do Fabricante
• https://github.com/ImageMagick/ImageMagick/blob/7.0.1-7/ChangeLog · Aviso do Fabricante
• https://bugzilla.suse.com/983234 · Nota
• https://ubuntu.com/security/CVE-2016-7532 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8895 · Nota
• https://ubuntu.com/security/CVE-2014-9815 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9823 · Aviso do Fabricante
• https://bugzilla.suse.com/984028 · Nota
• https://bugzilla.suse.com/983523 · Nota
• https://bugzilla.suse.com/983533 · Nota
• https://ubuntu.com/security/CVE-2016-7515 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9808 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5690 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8894 · Nota