In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | May 20, 2018 | Dec 27, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 24, 2017 |
| Suse | — | Upgrade libMagick++-develUpgrade libMagickWand1-32bitUpgrade libMagickCore1Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickCore1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1Upgrade ImageMagick-develUpgrade libMagick++1Upgrade libGraphicsMagick2Upgrade ImageMagickUpgrade libMagickWand1Upgrade perl-PerlMagickUpgrade perl-GraphicsMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade GraphicsMagick | Feb 4, 2018 | Dec 27, 2017 |
| Ubuntu | — | Upgrade libmagick++-6.q16-7Upgrade imagemagick-6.q16Upgrade libmagickcore5-extraUpgrade libmagick++5Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2-extraUpgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore5Upgrade libmagickcore-6.q16-2Upgrade libmagick++-6.q16-5v5 | Jun 19, 2018 | Dec 27, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub