PT-2016-7598 · Imagemagick+3 · Imagemagick+3

Asarubboo · Published 2016-06-05 · Updated 2021-04-26 · CVE-2016-8862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.3.3

Description The issue is related to the AcquireMagickMemory function in MagickCore/memory.c, which allows remote attackers to have an unspecified impact via a crafted image. This is triggered by a memory allocation failure.

Recommendations For versions prior to 7.0.3.3, update to version 7.0.3.3 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1580

ALT-PU-2017-2096

CVE-2016-8862

DLA-756-1

DSA-3726-1

MGASA-2018-0229

OPENSUSE-SU-2016_3060-1

OPENSUSE-SU-2016_3233-1

OPENSUSE-SU-2017_0023-1

SUSE-SU-2016:2894-1

SUSE-SU-2016:2952-1

SUSE-SU-2016:2964-1

SUSE-SU-2016_2894-1

SUSE-SU-2016_3256-1

SUSE-SU-2016_3258-1

SUSE-SU-2017_0305-1

USN-3142-1

USN-3142-2

Affected Products

Alt Linux

Imagemagick

Suse

Ubuntu

References · 102

• https://github.com/ImageMagick/ImageMagick/issues/271 · Patch
• https://cve.org/CVERecord?id=CVE-2016-8862 · Security Note
• http://openwall.com/lists/oss-security/2016/10/20/2 · Patch
• https://osv.dev/vulnerability/USN-3142-2 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8862 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8862 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8677 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3142-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9556 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7906 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2964-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-8862 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7799 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0229.html · Security Note