PT-2016-6644 · Imagemagick+3 · Imagemagick+3

Hanno Böck · Published 2016-06-05 · Updated 2016-12-16 · CVE-2016-5690

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.4-5 ImageMagick versions 7.x prior to 7.0.1-7

Description The issue concerns the ReadDCMImage function in the DCM reader of ImageMagick, allowing remote attackers to have an unspecified impact. This is achieved through vectors involving the for statement in computing the pixel scaling table.

Recommendations For ImageMagick versions prior to 6.9.4-5, update to version 6.9.4-5 or later. For ImageMagick versions 7.x prior to 7.0.1-7, update to version 7.0.1-7 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2016-1580

CVE-2016-5690

DLA-731-1

DSA-3652-1

OPENSUSE-SU-2016_1748-1

OPENSUSE-SU-2016_1833-1

SUSE-SU-2016:1782-1

SUSE-SU-2016:1784-1

USN-3131-1

Affected Products

Alt Linux

Imagemagick

Suse

Ubuntu

References · 263

• 🔥 https://github.com/ImageMagick/ImageMagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d · Exploit
• https://github.com/ImageMagick/ImageMagick/blob/6.9.4-5/ChangeLog · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick/blob/7.0.1-7/ChangeLog · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9823 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9808 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8896 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8903 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7528 · Vendor Advisory