Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Mar 2, 2017 | Feb 22, 2017 |
| Freebsd | — | Upgrade ImageMagick7Upgrade ImageMagick7-nox11Upgrade ImageMagickUpgrade ImageMagick-nox11 | May 25, 2017 | May 25, 2017 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Mar 24, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Mar 24, 2017 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Mar 24, 2017 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.7.4-0.175.3.18.0.1.0 on Solaris 11.3 | May 29, 2017 | Mar 24, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 5, 2017 |
| Suse | — | Upgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1Upgrade libMagickCore1-32bitUpgrade libMagickCore1Upgrade libMagick++1Upgrade ImageMagick-config-6-upstreamUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand1-32bitUpgrade ImageMagickUpgrade perl-PerlMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-SUSEUpgrade libMagickWand1Upgrade libMagick++-develUpgrade ImageMagick-devel | Feb 22, 2017 | Feb 21, 2017 |
| Ubuntu | — | Upgrade libmagickcore5Upgrade libmagick++-6.q16-5v5Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore4-extraUpgrade libmagickcore-6.q16-2Upgrade libmagickcore5-extraUpgrade libmagickcore4Upgrade imagemagickUpgrade libmagick++4Upgrade libmagick++5 | Mar 9, 2017 | Feb 22, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub