When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Dec 5, 2017 | Jul 26, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2017 |
| Suse | — | Upgrade libMagickWand-6_Q16-1Upgrade libMagick++-develUpgrade ImageMagick-develUpgrade perl-PerlMagickUpgrade libMagickCore-6_Q16-1Upgrade libMagickCore1-32bitUpgrade libMagick++-6_Q16-3Upgrade ImageMagickUpgrade ImageMagick-config-6-upstreamUpgrade ImageMagick-config-6-SUSEUpgrade libMagick++1Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand1-32bitUpgrade libMagickWand1Upgrade libMagickCore1 | Feb 4, 2018 | Jul 26, 2017 |
| Ubuntu | — | Upgrade libmagick++-6.q16-7Upgrade libmagick++5Upgrade libmagickcore5-extraUpgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-3Upgrade libmagickcore5Upgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16 | Jun 19, 2018 | Jul 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub