A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Nov 18, 2017 | Oct 2, 2017 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.19-0.175.3.26.0.4.0 on Solaris 11.3 | Nov 30, 2017 | Oct 2, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 25, 2017 |
| Suse | — | Upgrade imagemagickUpgrade libmagickcore-6_q16-1Upgrade imagemagick-develUpgrade libmagick-develUpgrade imagemagick-config-6-upstreamUpgrade libmagickwand-6_q16-1Upgrade imagemagick-config-6-suseUpgrade libmagickcore-6_q16-1-32bitUpgrade libmagick-6_q16-3Upgrade perl-perlmagick | Dec 20, 2017 | Oct 2, 2017 |
| Ubuntu | — | Upgrade libmagickcore5-extraUpgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-2Upgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore5Upgrade libmagick++5Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-3Upgrade libmagick++-6.q16-5v5 | Jun 19, 2018 | Oct 2, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub