PT-2017-1560 · Imagemagick+1 · Imagemagick+1

Masaaki Chida · Published 2016-06-05 · Updated 2017-03-24 · CVE-2016-10047

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.4-7

Description The issue is related to a memory leak in the NewXMLTree function in magick/xml-tree.c. This allows remote attackers to cause a denial of service by consuming memory via a crafted XML file.

Recommendations For versions prior to 6.9.4-7, update to version 6.9.4-7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the NewXMLTree function until a patch is available. Avoid processing untrusted XML files with the affected function to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2016-1580

BDU:2017-00705

CVE-2016-10047

DSA-3652-1

Affected Products

Alt Linux

Imagemagick

References · 113

• https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10047 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5689 · Security Note
• https://bdu.fstec.ru/vul/2017-00704 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8896 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7519 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6491 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7515 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10069 · Security Note
• https://bdu.fstec.ru/vul/2017-00706 · Security Note
• https://bdu.fstec.ru/vul/2017-00888 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8958 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7531 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7537 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7520 · Security Note