ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphicsmagick | Dec 11, 2017 | Sep 25, 2017 |
| Debian | — | Upgrade graphicsmagick | Oct 18, 2018 | Sep 25, 2017 |
| Suse | — | Upgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade ImageMagick-config-6-SUSEUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-develUpgrade perl-PerlMagickUpgrade libMagick++1Upgrade perl-GraphicsMagickUpgrade libMagickWand1Upgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade GraphicsMagickUpgrade libMagickCore1-32bitUpgrade libGraphicsMagick2Upgrade libMagick++-6_Q16-3Upgrade libMagickWand-6_Q16-1Upgrade libMagickCore1Upgrade libMagickWand1-32bit | Dec 12, 2017 | Sep 25, 2017 |
| Ubuntu | — | Upgrade graphicsmagickUpgrade libgraphicsmagick-q16-3Upgrade libgraphicsmagick++-q16-12 | Jan 9, 2020 | Sep 25, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub