In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Aug 21, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-c++ | Oct 28, 2020 | Aug 21, 2018 |
| Amazon_linux | — | Upgrade php70-pecl-imagickUpgrade ImageMagickUpgrade php55-pecl-imagickUpgrade php54-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php71-pecl-imagickUpgrade php56-pecl-imagick | Jul 18, 2020 | Aug 21, 2018 |
| Centos_linux | — | Upgrade inkscapeUpgrade ImageMagick-debuginfoUpgrade ImageMagick-perlUpgrade inkscape-docsUpgrade ImageMagickUpgrade ImageMagick-docUpgrade autotrace-develUpgrade ImageMagick-c++Upgrade inkscape-viewUpgrade autotrace-debuginfoUpgrade autotraceUpgrade ImageMagick-develUpgrade inkscape-debuginfoUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Aug 21, 2018 |
| Debian | — | No solution exists | May 15, 2025 | Aug 21, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Jan 3, 2020 | Aug 21, 2018 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.34-11.4.10.0.1.3.0 on Solaris 11.4 | Jun 26, 2019 | Aug 21, 2018 |
| Oracle_linux | — | Upgrade autotrace-develUpgrade ImageMagick-develUpgrade emacs-elUpgrade ImageMagick-perlUpgrade ImageMagickUpgrade emacs-noxUpgrade emacs-commonUpgrade ImageMagick-c++Upgrade emacsUpgrade autotraceUpgrade ImageMagick-docUpgrade inkscape-viewUpgrade emacs-filesystemUpgrade emacs-terminalUpgrade ImageMagick-c++-develUpgrade inkscape-docsUpgrade inkscape | Oct 5, 2022 | Aug 21, 2018 |
| Redhat_linux | — | Upgrade inkscape-debuginfoUpgrade inkscape-docsUpgrade ImageMagickUpgrade inkscapeUpgrade ImageMagick-perlUpgrade inkscape-viewUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade autotraceUpgrade autotrace-develUpgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++No solution existsUpgrade autotrace-debuginfo | Apr 1, 2020 | Aug 21, 2018 |
| Ubuntu | — | Upgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-6-extraUpgrade libmagick++-6.q16-8Upgrade imagemagickUpgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-6Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-3 | Jun 25, 2019 | Aug 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub