PT-2017-7720 · Imagemagick+1 · Imagemagick+1

Mateusz Jurczyk · Publicado 2016-06-05 · Atualizado 2020-10-14 · CVE-2016-10066

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.4-5

Description The issue is related to a buffer overflow in the ReadVIFFImage function, located in coders/viff.c. This can be exploited by remote attackers using a crafted file, leading to a denial of service, specifically causing the application to crash.

Recommendations For versions prior to 6.9.4-5, update to version 6.9.4-5 or later to resolve the issue.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

ALT-PU-2016-1580

CVE-2016-10066

DLA-756-1

DSA-3726-1

Produtos afetados

Alt Linux

Imagemagick

Referências · 64

• https://github.com/ImageMagick/ImageMagick/commit/f6e9d0d9955e85bdd7540b251cd50d598dacc5e6 · Nota
• https://github.com/ImageMagick/ImageMagick/commit/e45e48b881038487d0bc94d92a16c1537616cc0a · Aviso do Fabricante
• https://github.com/ImageMagick/ImageMagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9559 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5689 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10066 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00705 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1410491 · Nota
• https://bdu.fstec.ru/vul/2017-00703 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8896 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10063 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-00890 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5691 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7906 · Nota de Segurança
• http://imagemagick.org/discourse-server/viewtopic.php?f=3&t=26929 · Nota