ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 16, 2020 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp5 | — | — | Nov 19, 2019 | Sep 1, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Sep 1, 2018 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.14-11.4.4.0.1.3.0 on Solaris 11.4 | Dec 17, 2018 | Sep 1, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 1, 2018 |
| Suse | — | Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore-7_Q16HDRI6Upgrade libmagickwand-7_q16hdri6-32bitUpgrade libMagick++-develUpgrade libmagick-devel-32bitUpgrade libMagickWand-6_Q16-1Upgrade libGraphicsMagick2Upgrade perl-PerlMagickUpgrade ImageMagickUpgrade libMagickWand1Upgrade libMagick++-6_Q16-3Upgrade libMagickCore1Upgrade libmagickcore-7_q16hdri6-32bitUpgrade perl-GraphicsMagickUpgrade GraphicsMagickUpgrade ImageMagick-config-6-upstreamUpgrade imagemagick-config-7-upstreamUpgrade libMagickCore-6_Q16-1Upgrade libMagickWand-7_Q16HDRI6Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickCore1-32bitUpgrade ImageMagick-docUpgrade ImageMagick-extraUpgrade ImageMagick-develUpgrade libMagick++1Upgrade ImageMagick-config-7-SUSEUpgrade libmagick-7_q16hdri4-32bitUpgrade imagemagick-devel-32bitUpgrade libMagick++-7_Q16HDRI4Upgrade libMagickWand1-32bit | Sep 12, 2018 | Sep 1, 2018 |
| Ubuntu | — | Upgrade imagemagickUpgrade libmagickcore5Upgrade libmagickcore-6.q16-2Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-6-extraUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-6Upgrade libmagick++-6.q16-7Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-3Upgrade libmagickcore5-extraUpgrade libmagick++5Upgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-8 | Oct 17, 2018 | Sep 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub