PT-2017-10041 · Imagemagick+1 · Imagemagick+1

Bastien-Roucaries · Publicado 2017-01-27 · Atualizado 2018-05-12 · CVE-2016-9298

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.6-4 ImageMagick versions 7.x prior to 7.0.3-6

Description A heap overflow issue exists in the WaveletDenoiseImage function, located in MagickCore/fx.c, allowing remote attackers to cause a denial of service by crashing the system via a crafted image.

Recommendations For ImageMagick versions prior to 6.9.6-4, update to version 6.9.6-4 or later to resolve the issue. For ImageMagick versions 7.x prior to 7.0.3-6, update to version 7.0.3-6 or later to resolve the issue.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-2096

CVE-2016-9298

MGASA-2018-0229

Produtos afetados

Alt Linux

Imagemagick

Referências · 77

• https://github.com/ImageMagick/ImageMagick/issues/296 · Correção
• https://github.com/ImageMagick/ImageMagick/issues/506 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/526 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/591 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/519 · Nota
• https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02b · Correção
• https://github.com/ImageMagick/ImageMagick/issues/596 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/271 · Nota
• https://github.com/ImageMagick/ImageMagick/issues/586 · Nota
• https://bdu.fstec.ru/vul/2017-01776 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01779 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13139 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9298 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00694 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2018-0229 · Aviso do Fabricante