PT-2018-3692 · Imagemagick+4 · Imagemagick+4

Yangy-Xiao · Published 2018-07-05 · Updated 2020-09-08 · CVE-2018-16643

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-4

Description The issue is related to the functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage in the components coders/dcm.c, coders/pwp.c, coders/cals.c, and coders/pict.c, which do not check the return value of the fputc function. This allows remote attackers to cause a denial of service via a crafted image file. The exploitation of this issue can lead to a disruption in service.

Recommendations For ImageMagick version 7.0.8-4, consider disabling the functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage until a patch is available to prevent potential denial of service attacks. Restrict access to the components coders/dcm.c, coders/pwp.c, coders/cals.c, and coders/pict.c to minimize the risk of exploitation.

Fix

DoS

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

BDU:2021-03346

CESA-2020_1180

CVE-2018-16643

DLA-1530-1

DLA-2366-1

MGASA-2018-0496

OPENSUSE-SU-2018_3014-1

OPENSUSE-SU-2018_3203-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2018:2977-1

SUSE-SU-2018:3095-1

SUSE-SU-2018:3269-1

SUSE-SU-2018:3348-1

USN-3785-1

Affected Products

Centos

Imagemagick

Red Hat

Suse

Ubuntu

References · 85

• https://github.com/ImageMagick/ImageMagick/commit/6b6bff054d569a77973f2140c0e86366e6168a6c · Patch
• https://github.com/ImageMagick/ImageMagick/issues/1199 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2018:3095-1 · Vendor Advisory
• https://usn.ubuntu.com/3785-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14436 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16640 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16750 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03346 · Security Note
• https://osv.dev/vulnerability/USN-3785-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16749 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16 · Vendor Advisory