Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jun 5, 2012 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Jun 5, 2012 |
| Suse | — | Upgrade libMagickCore1Upgrade libMagickWand1-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagick++1Upgrade perl-PerlMagickUpgrade libMagickWand1Upgrade ImageMagick-config-7-upstream-limitedUpgrade libMagickWand-6_Q16-1Upgrade libMagickWand-7_Q16HDRI6Upgrade ImageMagick-config-7-upstream-secureUpgrade ImageMagick-docUpgrade libMagickCore1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade libMagick++-develUpgrade ImageMagick-config-7-SUSEUpgrade libMagick++-6_Q16-3Upgrade libMagick++-7_Q16HDRI4Upgrade ImageMagick-develUpgrade ImageMagick-config-7-upstream-websafeUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagick++-7_Q16HDRI5Upgrade ImageMagick-config-7-upstream-openUpgrade ImageMagickUpgrade ImageMagick-config-6-SUSEUpgrade ImageMagick-extraUpgrade libMagickCore-7_Q16HDRI10Upgrade libMagickWand-7_Q16HDRI10Upgrade libMagickCore-6_Q16-1-32bit | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade imagemagickUpgrade libmagick++4Upgrade libmagick++3Upgrade libmagick++2 | Nov 8, 2024 | Jun 5, 2012 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub