PT-2018-3205 · Imagemagick+2 · Imagemagick+2

Yan-1-20

·

Published

2018-09-03

·

Updated

2024-08-22

·

CVE-2018-16413

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.0.8 through 7.0.11
Description The issue is caused by a heap-based buffer over-read in the PushShortPixel function, located in MagickCore/quantum-private.h, which can be exploited by a remote attacker to execute arbitrary code. This function is called from the ParseImageResourceBlocks function in coders/psd.c.
Recommendations For ImageMagick versions 7.0.8 through 7.0.11, consider disabling the PushShortPixel function as a temporary workaround until a patch is available. Restrict access to the ParseImageResourceBlocks function in coders/psd.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2019-04347
CVE-2018-16413
DLA-1530-1
DSA-4316-1
OPENSUSE-SU-2018_3014-1
OPENSUSE-SU-2018_3203-1
OPENSUSE-SU-2019_1320-1
SUSE-SU-2018:2977-1
SUSE-SU-2018:3095-1
SUSE-SU-2018:3348-1
SUSE-SU-2019:1033-1
SUSE-SU-2019:1033-2
SUSE-SU-2019:13993-1
USN-4034-1
USN-6980-1

Affected Products

Imagemagick
Suse
Ubuntu