The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-docUpgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-perlUpgrade ImageMagick | Oct 28, 2020 | Jul 10, 2017 |
| Amazon_linux | — | Upgrade ImageMagickUpgrade php55-pecl-imagickUpgrade php70-pecl-imagickUpgrade php71-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php54-pecl-imagickUpgrade php56-pecl-imagick | Jul 18, 2020 | Jul 10, 2017 |
| Centos_linux | — | Upgrade inkscape-docsUpgrade autotraceUpgrade inkscapeUpgrade autotrace-debuginfoUpgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade inkscape-viewUpgrade inkscape-debuginfoUpgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagickUpgrade ImageMagick-perl | Apr 1, 2020 | Jul 10, 2017 |
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jul 10, 2017 |
| Oracle_linux | — | Upgrade autotraceUpgrade inkscape-docsUpgrade ImageMagick-develUpgrade inkscapeUpgrade emacs-noxUpgrade emacs-filesystemUpgrade emacs-terminalUpgrade ImageMagickUpgrade emacsUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade ImageMagick-docUpgrade emacs-elUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade inkscape-viewUpgrade emacs-common | Oct 5, 2022 | May 4, 2017 |
| Redhat_linux | — | Upgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagickNo solution existsUpgrade inkscape-debuginfoUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade inkscapeUpgrade ImageMagick-c++-develUpgrade autotraceUpgrade autotrace-debuginfoUpgrade inkscape-viewUpgrade ImageMagick-docUpgrade inkscape-docs | Apr 1, 2020 | Jul 10, 2017 |
| Suse | — | Upgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade libMagickWand1-32bitUpgrade ImageMagick-config-6-SUSEUpgrade perl-PerlMagickUpgrade libMagickWand1Upgrade libMagickWand-6_Q16-1Upgrade libMagick++-develUpgrade libMagickCore-6_Q16-1Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagick++1Upgrade libMagickCore1Upgrade libMagickCore1-32bitUpgrade ImageMagick-devel | Feb 21, 2018 | Jul 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub