ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp5 | — | — | Nov 19, 2019 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Sep 1, 2018 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.14-11.4.4.0.1.3.0 on Solaris 11.4 | Dec 17, 2018 | Sep 1, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 1, 2018 |
| Suse | — | Upgrade perl-PerlMagickUpgrade perl-GraphicsMagickUpgrade imagemagick-config-7-upstreamUpgrade GraphicsMagickUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-SUSEUpgrade libmagickwand-7_q16hdri6-32bitUpgrade libmagick-devel-32bitUpgrade libMagick++-develUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagickWand1Upgrade ImageMagick-config-6-upstreamUpgrade libMagick++-6_Q16-3Upgrade libMagickCore1Upgrade libGraphicsMagick2Upgrade ImageMagickUpgrade ImageMagick-extraUpgrade libMagick++1Upgrade libmagick-7_q16hdri4-32bitUpgrade ImageMagick-develUpgrade libMagickWand1-32bitUpgrade ImageMagick-docUpgrade libMagickCore-6_Q16-1Upgrade libMagickCore1-32bitUpgrade libMagickWand-7_Q16HDRI6Upgrade ImageMagick-config-7-SUSEUpgrade imagemagick-devel-32bitUpgrade libMagick++-7_Q16HDRI4Upgrade libMagickCore-6_Q16-1-32bit | Sep 12, 2018 | Sep 1, 2018 |
| Ubuntu | — | Upgrade libmagickcore-6.q16-6-extraUpgrade libmagickcore5Upgrade libmagickcore-6.q16-2Upgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-6Upgrade libmagickcore-6.q16-2-extraUpgrade imagemagick-6.q16Upgrade libmagick++-6.q16-7Upgrade libmagickcore5-extraUpgrade libmagick++5Upgrade libmagick++-6.q16-8Upgrade libmagickcore-6.q16-3 | Oct 17, 2018 | Sep 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub