PT-2006-3401 · Imagemagick+1 · Imagemagick+1

Eero Häkkinen · Published 2006-05-18 · Updated 2017-10-12 · CVE-2006-2440

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick version 6.0.6.2

Description A heap-based buffer overflow issue exists in the libMagick component. This issue might allow attackers to execute arbitrary code via an image index array that triggers the overflow during filename glob expansion by the ExpandFilenames function.

Recommendations For ImageMagick version 6.0.6.2, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the ExpandFilenames function until a patch is available.

Fix

Related Identifiers

CVE-2006-2440

DSA-1168-1

RHSA-2007:0015

RHSA-2007_0015

Affected Products

Imagemagick

Red Hat

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2006-2440 · Security Note
• http://debian.org/security/2006/dsa-1168 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-2440 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2440 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345595 · Patch
• https://security-tracker.debian.org/tracker/CVE-2006-2440 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0015.html · Vendor Advisory
• http://secunia.com/advisories/24284 · Note
• https://access.redhat.com/security/cve/CVE-2006-5868 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9481 · Note
• https://access.redhat.com/errata/RHSA-2007:0015 · Note
• https://access.redhat.com/security/cve/CVE-2006-5456 · Note
• https://access.redhat.com/security/cve/CVE-2006-2440 · Note
• http://secunia.com/advisories/24186 · Note