An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Mar 2, 2017 | Dec 23, 2016 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Dec 23, 2016 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Dec 23, 2016 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.7.4-0.175.3.18.0.1.0 on Solaris 11.3 | May 29, 2017 | Dec 23, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2016 |
| Suse | — | Upgrade libMagick++-develUpgrade ImageMagick-develUpgrade libMagickWand-6_Q16-1Upgrade libMagick++1Upgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade libMagickWand1Upgrade ImageMagickUpgrade libMagickCore1-32bitUpgrade perl-PerlMagickUpgrade libMagickWand1-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-6_Q16-3Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore1 | Dec 23, 2016 | Dec 23, 2016 |
| Ubuntu | — | Upgrade libmagickcore5-extraUpgrade libmagickcore4Upgrade libmagickcore4-extraUpgrade libmagick++5Upgrade imagemagick-6.q16Upgrade libmagick++4Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-2Upgrade libmagickcore5Upgrade imagemagick | Mar 9, 2017 | Dec 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub