Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphicsmagick | Aug 22, 2024 | Feb 3, 2017 |
| Amazon_linux | — | Upgrade GraphicsMagick | Jun 23, 2016 | Jun 22, 2016 |
| Debian | — | Upgrade graphicsmagick | Dec 26, 2016 | Jun 22, 2016 |
| Freebsd | — | Upgrade GraphicsMagick | Aug 14, 2018 | Aug 11, 2018 |
| Suse | — | Upgrade libGraphicsMagick2Upgrade graphicsmagickUpgrade perl-graphicsmagick | Jul 26, 2016 | Jun 22, 2016 |
| Ubuntu | — | Upgrade graphicsmagick | Nov 19, 2024 | Feb 3, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub