When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Dec 5, 2017 | Jul 26, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2017 |
| Suse | — | Upgrade libMagick++-develUpgrade ImageMagick-develUpgrade libMagickWand-6_Q16-1Upgrade perl-PerlMagickUpgrade libMagick++1Upgrade ImageMagickUpgrade libMagickCore1Upgrade libMagick++-6_Q16-3Upgrade libMagickCore1-32bitUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade ImageMagick-config-6-SUSEUpgrade libMagickWand1Upgrade libMagickCore-6_Q16-1 | Feb 4, 2018 | Jul 26, 2017 |
| Ubuntu | — | Upgrade imagemagickUpgrade libmagickcore-6.q16-2Upgrade libmagickcore-6.q16-3-extraUpgrade imagemagick-6.q16Upgrade libmagick++-6.q16-7Upgrade libmagick++5Upgrade libmagickcore5Upgrade libmagickcore-6.q16-3Upgrade libmagickcore5-extraUpgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-5v5 | Jun 19, 2018 | Jul 26, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub