PT-2007-6100 · Imagemagick+1 · Imagemagick+1

Published 2007-09-24 · Updated 2024-06-15 · CVE-2007-4988

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.3.5-9

Description The issue is related to a sign extension error in the ReadDIBImage function, which allows context-dependent attackers to execute arbitrary code. This is achieved by providing a crafted width value in an image file, triggering an integer overflow and a heap-based buffer overflow.

Recommendations For versions prior to 6.3.5-9, update to version 6.3.5-9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ReadDIBImage function until a patch is applied. Avoid using crafted image files that could trigger the integer overflow and heap-based buffer overflow.

Exploit

Fix

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2007-4988

DSA-1858-1

DSA-1903-1

DTSA-63-1

OPENSUSE-SU-2024:10596-1

RHSA-2008:0145

RHSA-2008_0145

Affected Products

Imagemagick

Red Hat

References · 56

• 🔥 http://securityfocus.com/bid/25765 · Exploit
• http://debian.org/security/2009/dsa-1858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4988 · Security Note
• http://mandriva.com/en/security/advisories?name=MDVSA-2008:035 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4988 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4988 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200710-27.xml · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10596-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0145.html · Vendor Advisory
• http://ubuntu.com/usn/usn-523-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4988 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_23_sr.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2006-3744 · Note
• http://secunia.com/advisories/27439 · Note
• https://issues.rpath.com/browse/RPL-1743 · Note