PT-2017-10325 · Imagemagick+1 · Imagemagick+1

Agostino Sarubbo · Published 2016-12-22 · Updated 2023-02-12 · CVE-2016-9773

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.3.8

Description A heap-based buffer overflow issue exists in the IsPixelGray function, allowing remote attackers to cause a denial of service via a crafted image file. This issue is a result of an incomplete fix for a previous problem.

Recommendations For ImageMagick version 7.0.3.8, consider avoiding the use of the IsPixelGray function until a complete fix is available. As a temporary workaround, restrict the processing of crafted image files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2016-9773

MGASA-2018-0229

OPENSUSE-SU-2016_3233-1

OPENSUSE-SU-2017_0023-1

SUSE-SU-2016:3256-1

SUSE-SU-2016:3258-1

Affected Products

Imagemagick

Suse

References · 38

• https://blogs.gentoo.org/ago/2016/12/01/imagemagick-heap-based-buffer-overflow-in-ispixelgray-pixel-accessor-h-incomplete-fix-for-cve-2016-9556 · Patch
• https://osv.dev/vulnerability/CVE-2016-9773 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3258-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9773 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3256-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0229.html · Security Note
• https://github.com/ImageMagick/ImageMagick/issues/271 · Note
• https://suse.com/security/cve/CVE-2016-8866.html · Note
• https://bugzilla.suse.com/1011136 · Note
• https://suse.com/security/cve/CVE-2014-9848 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/AVQ26OLHSJQIONEA5GPJGPLS752AHBQE · Note
• https://bugs.mageia.org/show_bug.cgi?id=19078 · Note
• https://suse.com/security/cve/CVE-2016-9556 · Note
• https://suse.com/support/update/announcement/2016/suse-su-20163256-1 · Note