The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Nov 18, 2017 | Nov 5, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 4, 2017 |
| Suse | — | Upgrade perl-PerlMagickUpgrade ImageMagick-config-6-SUSEUpgrade libMagick++-develUpgrade libMagick++-6_Q16-3Upgrade libMagickCore1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade GraphicsMagickUpgrade libGraphicsMagick2Upgrade perl-GraphicsMagickUpgrade ImageMagickUpgrade libMagickWand-6_Q16-1Upgrade libMagickWand1Upgrade libMagickCore1Upgrade libMagickCore-6_Q16-1Upgrade libMagickWand1-32bitUpgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-develUpgrade libMagick++1 | Dec 6, 2017 | Nov 5, 2017 |
| Ubuntu | — | Upgrade imagemagickUpgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-3Upgrade libmagickcore5Upgrade libmagick++5Upgrade libmagickcore5-extraUpgrade libmagickcore-6.q16-3-extraUpgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16 | Jun 19, 2018 | Nov 5, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub