ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Mar 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-debuginfoUpgrade ImageMagickUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-docUpgrade ImageMagick-c++ | Oct 28, 2020 | Mar 30, 2018 |
| Amazon_linux | — | Upgrade php55-pecl-imagickUpgrade php70-pecl-imagickUpgrade php72-pecl-imagickUpgrade ImageMagickUpgrade php-pecl-imagickUpgrade php71-pecl-imagickUpgrade php54-pecl-imagickUpgrade php56-pecl-imagick | Jul 18, 2020 | Mar 30, 2018 |
| Centos_linux | — | Upgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-perlUpgrade ImageMagick-develUpgrade ImageMagick-c++Upgrade inkscape-viewUpgrade autotraceUpgrade ImageMagick-docUpgrade inkscape-debuginfoUpgrade inkscapeUpgrade autotrace-debuginfoUpgrade inkscape-docsUpgrade ImageMagickUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Mar 30, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | May 25, 2022 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Mar 30, 2018 |
| Oracle_linux | — | Upgrade emacsUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-noxUpgrade ImageMagick-docUpgrade ImageMagickUpgrade inkscape-docsUpgrade inkscapeUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade emacs-elUpgrade ImageMagick-perlUpgrade emacs-commonUpgrade inkscape-viewUpgrade ImageMagick-c++-develUpgrade autotraceUpgrade ImageMagick-devel | Oct 5, 2022 | Mar 29, 2018 |
| Redhat_linux | — | Upgrade inkscapeUpgrade inkscape-viewUpgrade ImageMagickUpgrade inkscape-debuginfoUpgrade autotraceUpgrade inkscape-docsNo solution existsUpgrade autotrace-debuginfoUpgrade ImageMagick-docUpgrade ImageMagick-perlUpgrade ImageMagick-develUpgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++ | Apr 1, 2020 | Mar 30, 2018 |
| Suse | — | Upgrade perl-PerlMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade libMagickCore-6_Q16-1Upgrade ImageMagick-develUpgrade libMagick++-6_Q16-3Upgrade libMagick++-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-SUSEUpgrade ImageMagick | Jun 30, 2018 | Mar 30, 2018 |
| Ubuntu | — | Upgrade libmagickcore5Upgrade libmagick++-6.q16-7Upgrade libmagickcore5-extraUpgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-5v5Upgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagick++5Upgrade libmagickcore-6.q16-2 | Jun 19, 2018 | Mar 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub