Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jun 5, 2012 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Jun 5, 2012 |
| Suse | — | Upgrade libMagick++-develUpgrade ImageMagick-config-7-upstream-websafeUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagick++-7_Q16HDRI5Upgrade ImageMagick-config-7-upstream-openUpgrade ImageMagick-config-7-SUSEUpgrade libMagickCore-7_Q16HDRI10Upgrade ImageMagickUpgrade ImageMagick-extraUpgrade libMagick++-6_Q16-3Upgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-SUSEUpgrade libMagickWand-7_Q16HDRI10Upgrade libMagick++-7_Q16HDRI4Upgrade libMagickCore1-32bitUpgrade libMagickWand1-32bitUpgrade ImageMagick-config-7-upstream-limitedUpgrade libMagickCore-6_Q16-1Upgrade libMagickWand-6_Q16-1Upgrade libMagickCore1Upgrade libMagick++1Upgrade libMagickWand1Upgrade libMagickWand-7_Q16HDRI6Upgrade ImageMagick-config-7-upstream-secureUpgrade ImageMagick-docUpgrade perl-PerlMagickUpgrade ImageMagick-config-6-upstream | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade imagemagickUpgrade libmagick++4Upgrade libmagick++2Upgrade libmagick++3 | Nov 8, 2024 | Jun 5, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub