An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Mar 2, 2017 | Dec 23, 2016 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Dec 23, 2016 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Dec 23, 2016 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.7.4-0.175.3.18.0.1.0 on Solaris 11.3 | May 29, 2017 | Dec 23, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2016 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagick++1Upgrade libMagick++-develUpgrade libMagickWand-6_Q16-1Upgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade libMagick++-6_Q16-3Upgrade perl-PerlMagickUpgrade libMagickCore1-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagickWand1-32bitUpgrade ImageMagickUpgrade libMagickWand1Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore1 | Dec 23, 2016 | Dec 23, 2016 |
| Ubuntu | — | Upgrade imagemagick-6.q16Upgrade libmagick++4Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore5Upgrade libmagick++-6.q16-5v5Upgrade imagemagickUpgrade libmagickcore-6.q16-2Upgrade libmagickcore4Upgrade libmagickcore4-extraUpgrade libmagick++5Upgrade libmagickcore5-extra | Mar 9, 2017 | Dec 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub