PT-2018-3692 · Imagemagick+4 · Imagemagick+4

Yangy-Xiao

·

Publicado

2018-07-05

·

Atualizado

2020-09-08

·

CVE-2018-16643

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-4
Description The issue is related to the functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage in the components coders/dcm.c, coders/pwp.c, coders/cals.c, and coders/pict.c, which do not check the return value of the fputc function. This allows remote attackers to cause a denial of service via a crafted image file. The exploitation of this issue can lead to a disruption in service.
Recommendations For ImageMagick version 7.0.8-4, consider disabling the functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage until a patch is available to prevent potential denial of service attacks. Restrict access to the components coders/dcm.c, coders/pwp.c, coders/cals.c, and coders/pict.c to minimize the risk of exploitation.

Correção

DoS

Unchecked Return Value

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-252

Identificadores relacionados

BDU:2021-03346
CESA-2020_1180
CVE-2018-16643
DLA-1530-1
DLA-2366-1
MGASA-2018-0496
OPENSUSE-SU-2018_3014-1
OPENSUSE-SU-2018_3203-1
RHSA-2020:1180
RHSA-2020_1180
SUSE-SU-2018:2977-1
SUSE-SU-2018:3095-1
SUSE-SU-2018:3269-1
SUSE-SU-2018:3348-1
USN-3785-1

Produtos afetados

Centos
Imagemagick
Red Hat
Suse
Ubuntu