In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | May 20, 2018 | Dec 27, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 24, 2017 |
| Suse | — | Upgrade libGraphicsMagick2Upgrade perl-PerlMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade perl-GraphicsMagickUpgrade libMagickWand1Upgrade GraphicsMagickUpgrade libMagick++1Upgrade ImageMagick-develUpgrade libMagickCore1Upgrade libMagickWand1-32bitUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-develUpgrade ImageMagick-config-6-SUSEUpgrade libMagickCore1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1 | Feb 4, 2018 | Dec 27, 2017 |
| Ubuntu | — | Upgrade imagemagick-6.q16Upgrade libmagick++-6.q16-7Upgrade libmagick++5Upgrade libmagickcore5-extraUpgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2Upgrade imagemagickUpgrade libmagickcore5Upgrade libmagickcore-6.q16-3-extra | Jun 19, 2018 | Dec 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub