In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Oct 7, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Oct 7, 2018 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.14-11.4.4.0.1.3.0 on Solaris 11.4 | Dec 17, 2018 | Oct 7, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 7, 2018 |
| Suse | — | Upgrade perl-PerlMagickUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickCore1-32bitUpgrade ImageMagickUpgrade libMagickWand-7_Q16HDRI6Upgrade ImageMagick-config-6-SUSEUpgrade libMagickCore1Upgrade imagemagick-config-7-upstreamUpgrade GraphicsMagickUpgrade imagemagick-devel-32bitUpgrade ImageMagick-config-7-SUSEUpgrade libMagick++1Upgrade libMagickCore-6_Q16-1Upgrade perl-GraphicsMagickUpgrade libMagickWand1-32bitUpgrade libMagickWand1Upgrade ImageMagick-extraUpgrade libmagickwand-7_q16hdri6-32bitUpgrade libMagickCore-7_Q16HDRI6Upgrade ImageMagick-config-6-upstreamUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-develUpgrade libMagick++-develUpgrade libMagick++-7_Q16HDRI4Upgrade libGraphicsMagick2Upgrade libmagick-devel-32bitUpgrade libmagickcore-7_q16hdri6-32bitUpgrade ImageMagick-docUpgrade libmagick-7_q16hdri4-32bit | Oct 17, 2018 | Oct 7, 2018 |
| Ubuntu | — | Upgrade imagemagickUpgrade imagemagick (Ubuntu Pro)Upgrade libmagickwand5 (Ubuntu Pro)Upgrade libmagick++5 (Ubuntu Pro)Upgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16Upgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-6Upgrade perlmagick (Ubuntu Pro)Upgrade libmagick++-6.q16-7Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickwand-dev (Ubuntu Pro)Upgrade libmagickcore-6.q16-6-extraUpgrade libmagickcore-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-8 | Jun 25, 2019 | Oct 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub