The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-docUpgrade ImageMagickUpgrade ImageMagick-perl | Oct 28, 2020 | Jul 10, 2017 |
| Amazon_linux | — | Upgrade php54-pecl-imagickUpgrade php56-pecl-imagickUpgrade php72-pecl-imagickUpgrade ImageMagickUpgrade php-pecl-imagickUpgrade php70-pecl-imagickUpgrade php55-pecl-imagickUpgrade php71-pecl-imagick | Jul 18, 2020 | Jul 10, 2017 |
| Centos_linux | — | Upgrade ImageMagickUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade inkscape-debuginfoUpgrade autotraceUpgrade inkscape-viewUpgrade autotrace-debuginfoUpgrade ImageMagick-c++-develUpgrade inkscape-docsUpgrade ImageMagick-docUpgrade inkscape | Apr 1, 2020 | Jul 10, 2017 |
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jul 10, 2017 |
| Oracle_linux | — | Upgrade inkscape-docsUpgrade ImageMagick-perlUpgrade autotrace-develUpgrade autotraceUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-noxUpgrade ImageMagickUpgrade emacsUpgrade inkscapeUpgrade ImageMagick-develUpgrade ImageMagick-c++Upgrade emacs-elUpgrade ImageMagick-docUpgrade inkscape-viewUpgrade ImageMagick-c++-develUpgrade emacs-common | Oct 5, 2022 | May 4, 2017 |
| Redhat_linux | — | Upgrade ImageMagick-develUpgrade inkscape-debuginfoUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-perlNo solution existsUpgrade autotrace-develUpgrade ImageMagickUpgrade autotraceUpgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade inkscape-viewUpgrade inkscape-docsUpgrade autotrace-debuginfoUpgrade inkscape | Apr 1, 2020 | Jul 10, 2017 |
| Suse | — | Upgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade libMagickWand1Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-SUSEUpgrade perl-PerlMagickUpgrade libMagickWand1-32bitUpgrade libMagick++-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-6_Q16-3Upgrade ImageMagick-develUpgrade libMagick++1Upgrade libMagickCore1Upgrade libMagickCore1-32bit | Feb 21, 2018 | Jul 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub