PT-2006-4985 · Imagemagick+1 · Imagemagick+1

Published 2006-08-15 · Updated 2018-10-17 · CVE-2006-4144

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.2.9

Description The issue is related to an integer overflow in the ReadSGIImage function in sgi.c, which can be triggered by large values of bytes per pixel, columns, and rows. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code via a heap-based buffer overflow.

Recommendations For versions prior to 6.2.9, update to version 6.2.9 or later to resolve the issue. As a temporary workaround, consider restricting the input values for bytes per pixel, columns, and rows to prevent large values from being processed.

Exploit

Fix

Related Identifiers

CVE-2006-4144

DSA-1213

RHSA-2006:0633

RHSA-2006_0633

Affected Products

Imagemagick

Red Hat

References · 34

• 🔥 https://exploit-db.com/exploits/28383 · Exploit
• 🔥 http://securityfocus.com/bid/19507 · Exploit
• 🔥 http://overflow.pl/adv/imsgiheap.txt · Exploit
• ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-4144 · Vendor Advisory
• http://debian.org/security/2006/dsa-1213 · Vendor Advisory
• http://secunia.com/advisories/21462 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4144 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:155 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200609-14.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-337-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4144 · Security Note
• http://novell.com/linux/security/advisories/2006_50_imagemagick.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0633.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-4144 · Vendor Advisory