PT-2016-3149 · Imagemagick+3 · Imagemagick+3

Adam Mariš · Published 2016-08-25 · Updated 2017-08-22 · CVE-2016-7539

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7

Description The issue is related to a memory leak in the AcquireVirtualMemory component of ImageMagick, which can be exploited by remote attackers to cause a denial of service through memory consumption. The exact vectors used for the exploitation are not specified.

Recommendations For versions prior to 7, update to version 7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the AcquireVirtualMemory component to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2017-2096

BDU:2017-01781

CVE-2016-7539

DLA-731-1

DSA-3652-1

SUSE-SU-2016:2667-1

USN-3131-1

Affected Products

Alt Linux

Imagemagick

Suse

Ubuntu

References · 207

• https://github.com/ImageMagick/ImageMagick/commit/4e81ce8b07219c69a9aeccb0f7f7b927ca6db74c · Patch
• https://ubuntu.com/security/CVE-2016-7532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9823 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9808 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8896 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8903 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7528 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9835 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8957 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-7539 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7527 · Vendor Advisory