PT-2017-10041 · Imagemagick+1 · Imagemagick+1

Bastien-Roucaries · Published 2017-01-27 · Updated 2018-05-12 · CVE-2016-9298

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.6-4 ImageMagick versions 7.x prior to 7.0.3-6

Description A heap overflow issue exists in the WaveletDenoiseImage function, located in MagickCore/fx.c, allowing remote attackers to cause a denial of service by crashing the system via a crafted image.

Recommendations For ImageMagick versions prior to 6.9.6-4, update to version 6.9.6-4 or later to resolve the issue. For ImageMagick versions 7.x prior to 7.0.3-6, update to version 7.0.3-6 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-2096

CVE-2016-9298

MGASA-2018-0229

Affected Products

Alt Linux

Imagemagick

References · 77

• https://github.com/ImageMagick/ImageMagick/issues/296 · Patch
• https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02b · Patch
• https://bdu.fstec.ru/vul/2017-01776 · Security Note
• https://bdu.fstec.ru/vul/2017-01779 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13139 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9298 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00694 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01460 · Security Note
• http://openwall.com/lists/oss-security/2016/11/13/1 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11352 · Security Note
• https://bdu.fstec.ru/vul/2017-01778 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12877 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13142 · Security Note
• https://bdu.fstec.ru/vul/2021-03377 · Security Note