Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jun 5, 2012 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Jun 5, 2012 |
| Suse | — | Upgrade ImageMagick-config-7-upstream-limitedUpgrade libMagickWand-7_Q16HDRI6Upgrade libMagickCore-6_Q16-1Upgrade libMagickCore1Upgrade libMagick++-7_Q16HDRI5Upgrade libMagickCore1-32bitUpgrade ImageMagick-config-7-upstream-secureUpgrade ImageMagick-develUpgrade libMagick++-6_Q16-3Upgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-docUpgrade perl-PerlMagickUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand1-32bitUpgrade libMagick++1Upgrade libMagickWand-7_Q16HDRI10Upgrade ImageMagick-config-6-upstreamUpgrade libMagick++-develUpgrade libMagick++-7_Q16HDRI4Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagickWand1Upgrade libMagickCore-7_Q16HDRI10Upgrade libMagickWand-6_Q16-1Upgrade ImageMagickUpgrade ImageMagick-config-7-upstream-websafeUpgrade ImageMagick-config-7-upstream-openUpgrade ImageMagick-extra | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libmagick++2Upgrade libmagick++4Upgrade imagemagickUpgrade libmagick++3 | Nov 8, 2024 | Jun 5, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub