In GraphicsMagick 1.3.27, there is an infinite loop and application hang in the ReadBMPImage function (coders/bmp.c). Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade graphicsmagick | Aug 22, 2024 | Jan 14, 2018 |
| Amazon_linux | — | Upgrade GraphicsMagick | Mar 9, 2018 | Jan 13, 2018 |
| Debian | — | Upgrade graphicsmagick | Oct 18, 2018 | Jan 13, 2018 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++1Upgrade ImageMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade libMagickCore1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickWand1Upgrade libGraphicsMagick2Upgrade ImageMagick-config-6-SUSEUpgrade GraphicsMagickUpgrade libMagickWand1-32bitUpgrade perl-PerlMagickUpgrade libMagickCore1Upgrade perl-GraphicsMagick | Feb 4, 2018 | Jan 13, 2018 |
| Ubuntu | — | Upgrade graphicsmagickUpgrade graphicsmagick (Ubuntu Pro)Upgrade libgraphicsmagick-q16-3Upgrade libgraphicsmagick-q16-3 (Ubuntu Pro)Upgrade libgraphicsmagick3 (Ubuntu Pro) | Apr 10, 2023 | Jan 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub