HIGH7.1
Уязвимость консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:C
ALT-PU-2017-2096-2Обновление пакета ImageMagick в ветке sisyphus
Серьёзность:
Закрытые проблемы (60)
MEDIUM4.3
Уязвимость операционной системы OpenSUSE Leap, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PHIGH7.8
Уязвимости консольного графического редактора ImageMagick, позволяющие нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.5
Уязвимость компонента coders/wpg.c консольного графического редактора ImageMagick, позволяющая нарушителю оказать неопределенное воздействие
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PHIGH7.5
Уязвимость компонента coders/ipl.c консольного графического редактора ImageMagick, позволяющая нарушителю оказать неопределенное воздействие
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PHIGH7.8
Уязвимость компонента coders/mpc.c консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CHIGH7.5
Уязвимость компонента coders/psd.c консольного графического редактора ImageMagick, позволяющая нарушителю оказать неопределенное воздействие
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PHIGH7.1
Уязвимость функции ReadEPTImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.1
Уязвимость функции ReadDPXImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.1
Уязвимость функции ReadOneMNGImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CHIGH7.1
Уязвимость функции ReadCINImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CHIGH7.1
Уязвимость функции ReadTXTImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.1
Уязвимость функции ReadOneJNGImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.1
Уязвимость функции ReadOneDJVUImage консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CСсылки
HIGH7.8
Уязвимость компонента AcquireVirtualMemory консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CMEDIUM4.3
Уязвимость функции ProcessMSLScript в coders/msl.c консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PСсылки
HIGH7.5
Уязвимость функции ReadOneMNGImage консольного графического редактора ImageMagick, позволяющая нарушителю произвести чтение за границами памяти
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PСсылки
MEDIUM6.5
Уязвимость функции ReadMATImage компонента coders/mat.c консольного графического редактора ImageMagick, связанная с недостатком использования функции assert(), позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PСсылки
MEDIUM5.5
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95212
- https://bugzilla.redhat.com/show_bug.cgi?id=1410467
- https://github.com/ImageMagick/ImageMagick/commit/47e8e6ceef979327614d0b8f0c76c6ecb18e09cf
- https://github.com/ImageMagick/ImageMagick/commit/4ec444f4eab88cf4bec664fafcf9cab50bc5ff6a
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95212
- https://bugzilla.redhat.com/show_bug.cgi?id=1410467
- https://github.com/ImageMagick/ImageMagick/commit/47e8e6ceef979327614d0b8f0c76c6ecb18e09cf
- https://github.com/ImageMagick/ImageMagick/commit/4ec444f4eab88cf4bec664fafcf9cab50bc5ff6a
HIGH7.8
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95213
- https://bugzilla.redhat.com/show_bug.cgi?id=1410482
- https://github.com/ImageMagick/ImageMagick/commit/134463b926fa965571aa4febd61b810be5e7da05
- https://github.com/ImageMagick/ImageMagick/issues/129
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95213
- https://bugzilla.redhat.com/show_bug.cgi?id=1410482
- https://github.com/ImageMagick/ImageMagick/commit/134463b926fa965571aa4febd61b810be5e7da05
- https://github.com/ImageMagick/ImageMagick/issues/129
MEDIUM5.5
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95219
- https://bugzilla.redhat.com/show_bug.cgi?id=1410500
- https://github.com/ImageMagick/ImageMagick/commit/56d6e20de489113617cbbddaf41e92600a34db22
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30797
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
- http://www.openwall.com/lists/oss-security/2016/12/26/9
- http://www.securityfocus.com/bid/95219
- https://bugzilla.redhat.com/show_bug.cgi?id=1410500
- https://github.com/ImageMagick/ImageMagick/commit/56d6e20de489113617cbbddaf41e92600a34db22
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30797
CRITICAL9.8
coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95750
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851485
- https://github.com/ImageMagick/ImageMagick/commit/97566cf2806c0a5a86e884c96831a0c3b1ec6c20
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95750
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851485
- https://github.com/ImageMagick/ImageMagick/commit/97566cf2806c0a5a86e884c96831a0c3b1ec6c20
- https://security.gentoo.org/glsa/201702-09
CRITICAL9.8
Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95749
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483
- https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95749
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483
- https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9
- https://security.gentoo.org/glsa/201702-09
HIGH7.5
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95744
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851380
- https://github.com/ImageMagick/ImageMagick/commit/aeff00de228bc5a158c2a975ab47845d8a1db456
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95744
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851380
- https://github.com/ImageMagick/ImageMagick/commit/aeff00de228bc5a158c2a975ab47845d8a1db456
- https://security.gentoo.org/glsa/201702-09
HIGH7.5
Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=28946
- http://www.openwall.com/lists/oss-security/2016/09/22/2
- http://www.securityfocus.com/bid/93232
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833101
- https://bugzilla.redhat.com/show_bug.cgi?id=1378776
- https://github.com/ImageMagick/ImageMagick/commit/4e81ce8b07219c69a9aeccb0f7f7b927ca6db74c
- http://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=28946
- http://www.openwall.com/lists/oss-security/2016/09/22/2
- http://www.securityfocus.com/bid/93232
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833101
- https://bugzilla.redhat.com/show_bug.cgi?id=1378776
- https://github.com/ImageMagick/ImageMagick/commit/4e81ce8b07219c69a9aeccb0f7f7b927ca6db74c
HIGH8.8
The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00085.html
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00141.html
- http://www.openwall.com/lists/oss-security/2016/10/20/3
- http://www.openwall.com/lists/oss-security/2016/10/21/5
- https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/
- https://bugzilla.redhat.com/show_bug.cgi?id=1388816
- https://github.com/ImageMagick/ImageMagick/issues/271
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00085.html
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00141.html
- http://www.openwall.com/lists/oss-security/2016/10/20/3
- http://www.openwall.com/lists/oss-security/2016/10/21/5
- https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/
- https://bugzilla.redhat.com/show_bug.cgi?id=1388816
- https://github.com/ImageMagick/ImageMagick/issues/271
MEDIUM5.5
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2016/11/13/1
- http://www.openwall.com/lists/oss-security/2016/11/14/10
- http://www.securityfocus.com/bid/94310
- https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
- https://github.com/ImageMagick/ImageMagick/issues/296
- https://security.gentoo.org/glsa/201702-09
- http://www.openwall.com/lists/oss-security/2016/11/13/1
- http://www.openwall.com/lists/oss-security/2016/11/14/10
- http://www.securityfocus.com/bid/94310
- https://github.com/ImageMagick/ImageMagick/commit/3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
- https://github.com/ImageMagick/ImageMagick/issues/296
- https://security.gentoo.org/glsa/201702-09
MEDIUM6.5
coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2016/dsa-3726
- http://www.openwall.com/lists/oss-security/2016/11/19/7
- http://www.openwall.com/lists/oss-security/2016/11/23/4
- http://www.securityfocus.com/bid/94489
- https://blogs.gentoo.org/ago/2016/11/19/imagemagick-null-pointer-must-never-be-null-tiff-c/
- https://github.com/ImageMagick/ImageMagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b
- https://github.com/ImageMagick/ImageMagick/issues/298
- http://www.debian.org/security/2016/dsa-3726
- http://www.openwall.com/lists/oss-security/2016/11/19/7
- http://www.openwall.com/lists/oss-security/2016/11/23/4
- http://www.securityfocus.com/bid/94489
- https://blogs.gentoo.org/ago/2016/11/19/imagemagick-null-pointer-must-never-be-null-tiff-c/
- https://github.com/ImageMagick/ImageMagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b
- https://github.com/ImageMagick/ImageMagick/issues/298
MEDIUM6.5
In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9144.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.securityfocus.com/bid/99600
- https://bugs.debian.org/868469
- https://github.com/ImageMagick/ImageMagick/issues/502
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4040
- http://www.securityfocus.com/bid/99600
- https://bugs.debian.org/868469
- https://github.com/ImageMagick/ImageMagick/issues/502
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4040
MEDIUM6.5
The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:NCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867893
- https://github.com/ImageMagick/ImageMagick/commit/f6463ca9588579633bbaed9460899d892aa3c64a
- https://github.com/ImageMagick/ImageMagick/issues/556
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867893
- https://github.com/ImageMagick/ImageMagick/commit/f6463ca9588579633bbaed9460899d892aa3c64a
- https://github.com/ImageMagick/ImageMagick/issues/556
HIGH8.8
coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- http://www.securityfocus.com/bid/99958
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867896
- https://github.com/ImageMagick/ImageMagick/commit/529ff26b68febb2ac03062c58452ea0b4c6edbc1
- https://github.com/ImageMagick/ImageMagick/commit/b007dd3a048097d8f58949297f5b434612e1e1a3
- https://github.com/ImageMagick/ImageMagick/issues/556
- http://www.securityfocus.com/bid/99958
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867896
- https://github.com/ImageMagick/ImageMagick/commit/529ff26b68febb2ac03062c58452ea0b4c6edbc1
- https://github.com/ImageMagick/ImageMagick/commit/b007dd3a048097d8f58949297f5b434612e1e1a3
- https://github.com/ImageMagick/ImageMagick/issues/556
HIGH8.8
coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867894
- https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602
- https://github.com/ImageMagick/ImageMagick/issues/556
- https://security-tracker.debian.org/tracker/CVE-2017-11450
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867894
- https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602
- https://github.com/ImageMagick/ImageMagick/issues/556
- https://security-tracker.debian.org/tracker/CVE-2017-11450
MEDIUM6.5
The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a malformed JNG file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The WriteOnePNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/869209
- https://github.com/ImageMagick/ImageMagick/commit/816ecab6c532ae086ff4186b3eaf4aa7092d536f
- https://github.com/ImageMagick/ImageMagick/issues/586
- https://bugs.debian.org/869209
- https://github.com/ImageMagick/ImageMagick/commit/816ecab6c532ae086ff4186b3eaf4aa7092d536f
- https://github.com/ImageMagick/ImageMagick/issues/586
MEDIUM6.5
The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/869210
- https://github.com/ImageMagick/ImageMagick/commit/83e0f8ffd7eeb7661b0ff83257da23d24ca7f078
- https://github.com/ImageMagick/ImageMagick/commit/a8f9c2aabed37cd6a728532d1aed13ae0f3dfd78
- https://github.com/ImageMagick/ImageMagick/issues/591
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://www.debian.org/security/2017/dsa-4019
- https://bugs.debian.org/869210
- https://github.com/ImageMagick/ImageMagick/commit/83e0f8ffd7eeb7661b0ff83257da23d24ca7f078
- https://github.com/ImageMagick/ImageMagick/commit/a8f9c2aabed37cd6a728532d1aed13ae0f3dfd78
- https://github.com/ImageMagick/ImageMagick/issues/591
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://www.debian.org/security/2017/dsa-4019
MEDIUM6.5
The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
MEDIUM6.5
The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
MEDIUM6.5
The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
MEDIUM6.5
The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The ReadMATImage function in coders/mat.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
CVSS 2.0ВЫСОКАЯ 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:CCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMEDIUM6.5
The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://github.com/ImageMagick/ImageMagick/commit/e793eb203e5e0f91f5037aed6585e81b1e27395b
- https://github.com/ImageMagick/ImageMagick/issues/636
- https://security.gentoo.org/glsa/201711-07
- https://github.com/ImageMagick/ImageMagick/commit/e793eb203e5e0f91f5037aed6585e81b1e27395b
- https://github.com/ImageMagick/ImageMagick/issues/636
- https://security.gentoo.org/glsa/201711-07
MEDIUM6.5
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/08/16/2
- https://blogs.gentoo.org/ago/2017/08/10/imagemagick-use-after-free-in-destroyimage-image-c/
- https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4040
- https://www.debian.org/security/2017/dsa-4074
- http://www.openwall.com/lists/oss-security/2017/08/16/2
- https://blogs.gentoo.org/ago/2017/08/10/imagemagick-use-after-free-in-destroyimage-image-c/
- https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4040
- https://www.debian.org/security/2017/dsa-4074
CRITICAL9.8
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.securityfocus.com/bid/100494
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870109
- https://github.com/ImageMagick/ImageMagick/commit/d072ed6aff835c174e856ce3a428163c0da9e8f4
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2017/dsa-4040
- http://www.securityfocus.com/bid/100494
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870109
- https://github.com/ImageMagick/ImageMagick/commit/d072ed6aff835c174e856ce3a428163c0da9e8f4
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2017/dsa-4040
MEDIUM6.5
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870111
- https://github.com/ImageMagick/ImageMagick/issues/596
- https://security.gentoo.org/glsa/201711-07
- https://www.debian.org/security/2017/dsa-4019
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870111
- https://github.com/ImageMagick/ImageMagick/issues/596
- https://security.gentoo.org/glsa/201711-07
- https://www.debian.org/security/2017/dsa-4019
MEDIUM6.5
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870116
- https://github.com/ImageMagick/ImageMagick/issues/600
- https://security.gentoo.org/glsa/201711-07
- https://www.debian.org/security/2017/dsa-4019
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870116
- https://github.com/ImageMagick/ImageMagick/issues/600
- https://security.gentoo.org/glsa/201711-07
- https://www.debian.org/security/2017/dsa-4019
MEDIUM6.5
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870105
- https://github.com/ImageMagick/ImageMagick/commit/46e3aabbf8d59a1bdebdbb65acb9b9e0484577d3
- https://github.com/ImageMagick/ImageMagick/commit/aa84944b405acebbeefe871d0f64969b9e9f31ac
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870105
- https://github.com/ImageMagick/ImageMagick/commit/46e3aabbf8d59a1bdebdbb65acb9b9e0484577d3
- https://github.com/ImageMagick/ImageMagick/commit/aa84944b405acebbeefe871d0f64969b9e9f31ac
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
HIGH7.5
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870012
- https://github.com/ImageMagick/ImageMagick/commit/51b0ae01709adc1e4a9245e158ef17b85a110960
- https://github.com/ImageMagick/ImageMagick/issues/362
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2018/dsa-4204
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870012
- https://github.com/ImageMagick/ImageMagick/commit/51b0ae01709adc1e4a9245e158ef17b85a110960
- https://github.com/ImageMagick/ImageMagick/issues/362
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2018/dsa-4204
MEDIUM6.5
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2017/dsa-4040
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31438
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://www.debian.org/security/2017/dsa-4040
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31438
MEDIUM6.5
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869830
- https://github.com/ImageMagick/ImageMagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa
- https://github.com/ImageMagick/ImageMagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0
- https://github.com/ImageMagick/ImageMagick/issues/501
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869830
- https://github.com/ImageMagick/ImageMagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa
- https://github.com/ImageMagick/ImageMagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0
- https://github.com/ImageMagick/ImageMagick/issues/501
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://security.gentoo.org/glsa/201711-07
- https://usn.ubuntu.com/3681-1/
- https://www.debian.org/security/2017/dsa-4019
HIGH8.8
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870013
- https://github.com/ImageMagick/ImageMagick/commit/79e5dbcdd1fc2f714f9bae548bc55d5073f3ed20
- https://security.gentoo.org/glsa/201711-07
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870013
- https://github.com/ImageMagick/ImageMagick/commit/79e5dbcdd1fc2f714f9bae548bc55d5073f3ed20
- https://security.gentoo.org/glsa/201711-07
MEDIUM6.5
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870019
- https://github.com/ImageMagick/ImageMagick/commit/e5c063a1007506ba69e97a35effcdef944421c89
- https://github.com/ImageMagick/ImageMagick/issues/598
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870019
- https://github.com/ImageMagick/ImageMagick/commit/e5c063a1007506ba69e97a35effcdef944421c89
- https://github.com/ImageMagick/ImageMagick/issues/598
- https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
HIGH7.5
Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95752
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851382
- https://github.com/ImageMagick/ImageMagick/blob/6.9.7-4/ChangeLog
- https://github.com/ImageMagick/ImageMagick/blob/7.0.4-4/ChangeLog
- https://github.com/ImageMagick/ImageMagick/commit/66e283e0a9c141b19fe6c4c39f4a41c0d3188ba8
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95752
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851382
- https://github.com/ImageMagick/ImageMagick/blob/6.9.7-4/ChangeLog
- https://github.com/ImageMagick/ImageMagick/blob/7.0.4-4/ChangeLog
- https://github.com/ImageMagick/ImageMagick/commit/66e283e0a9c141b19fe6c4c39f4a41c0d3188ba8
- https://security.gentoo.org/glsa/201702-09
MEDIUM5.5
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95748
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851381
- https://github.com/ImageMagick/ImageMagick/blob/6.9.7-3/ChangeLog
- https://github.com/ImageMagick/ImageMagick/blob/7.0.4-3/ChangeLog
- https://github.com/ImageMagick/ImageMagick/commit/c073a7712d82476b5fbee74856c46b88af9c3175
- https://security.gentoo.org/glsa/201702-09
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31161
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95748
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851381
- https://github.com/ImageMagick/ImageMagick/blob/6.9.7-3/ChangeLog
- https://github.com/ImageMagick/ImageMagick/blob/7.0.4-3/ChangeLog
- https://github.com/ImageMagick/ImageMagick/commit/c073a7712d82476b5fbee74856c46b88af9c3175
- https://security.gentoo.org/glsa/201702-09
- https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31161
HIGH7.8
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95751
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851377
- https://github.com/ImageMagick/ImageMagick/commit/37a1710e2dab6ed91128ea648d654a22fbe2a6af
- https://github.com/ImageMagick/ImageMagick/commit/d4ec73f866a7c42a2e7f301fcd696e5cb7a7d3ab
- https://github.com/ImageMagick/ImageMagick/issues/350
- https://security.gentoo.org/glsa/201702-09
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95751
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851377
- https://github.com/ImageMagick/ImageMagick/commit/37a1710e2dab6ed91128ea648d654a22fbe2a6af
- https://github.com/ImageMagick/ImageMagick/commit/d4ec73f866a7c42a2e7f301fcd696e5cb7a7d3ab
- https://github.com/ImageMagick/ImageMagick/issues/350
- https://security.gentoo.org/glsa/201702-09
HIGH7.8
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95755
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851376
- https://github.com/ImageMagick/ImageMagick/commit/91cc3f36f2ccbd485a0456bab9aebe63b635da88
- https://github.com/ImageMagick/ImageMagick/commit/e87af64b1ff1635a32d9b6162f1b0e260fb54ed9
- https://github.com/ImageMagick/ImageMagick/issues/348
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95755
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851376
- https://github.com/ImageMagick/ImageMagick/commit/91cc3f36f2ccbd485a0456bab9aebe63b635da88
- https://github.com/ImageMagick/ImageMagick/commit/e87af64b1ff1635a32d9b6162f1b0e260fb54ed9
- https://github.com/ImageMagick/ImageMagick/issues/348
- https://security.gentoo.org/glsa/201702-09
CRITICAL9.8
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
CVSS 2.0ВЫСОКАЯ 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HСсылки
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95746
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851374
- https://github.com/ImageMagick/ImageMagick/commit/7d65a814ac76bd04760072c33e452371692ee790
- https://github.com/ImageMagick/ImageMagick/commit/c8c6a0f123d5e35c173125365c97e2c0fc7eca42
- https://github.com/ImageMagick/ImageMagick/issues/347
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95746
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851374
- https://github.com/ImageMagick/ImageMagick/commit/7d65a814ac76bd04760072c33e452371692ee790
- https://github.com/ImageMagick/ImageMagick/commit/c8c6a0f123d5e35c173125365c97e2c0fc7eca42
- https://github.com/ImageMagick/ImageMagick/issues/347
- https://security.gentoo.org/glsa/201702-09
HIGH7.5
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NСсылки
- http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.c
- http://www.debian.org/security/2017/dsa-3863
- http://www.securityfocus.com/bid/98593
- https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b
- https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
- https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html
- http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.c
- http://www.debian.org/security/2017/dsa-3863
- http://www.securityfocus.com/bid/98593
- https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b
- https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
- https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html