In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 16, 2018 | May 18, 2018 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.40-0.175.3.32.0.1.0 on Solaris 11.3 | Aug 24, 2018 | May 18, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 18, 2018 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagickWand-6_Q16-1Upgrade libMagick++-develUpgrade libMagick++1Upgrade libMagickWand1-32bitUpgrade libMagickCore1Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-6_Q16-3Upgrade libMagickCore1-32bitUpgrade ImageMagickUpgrade ImageMagick-config-6-SUSEUpgrade perl-PerlMagickUpgrade ImageMagick-config-6-upstreamUpgrade libMagickWand1 | Jun 30, 2018 | May 18, 2018 |
| Ubuntu | — | Upgrade libmagick++5Upgrade libmagickcore5-extraUpgrade libmagick++-6.q16-7Upgrade imagemagickUpgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore5Upgrade libmagickcore-6.q16-3Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-3-extra | Jun 19, 2018 | May 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub