ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Mar 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagickUpgrade ImageMagick-devel | Oct 28, 2020 | Mar 30, 2018 |
| Amazon_linux | — | Upgrade ImageMagickUpgrade php55-pecl-imagickUpgrade php70-pecl-imagickUpgrade php71-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php54-pecl-imagickUpgrade php56-pecl-imagick | Jul 18, 2020 | Mar 30, 2018 |
| Centos_linux | — | Upgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++-develUpgrade ImageMagickUpgrade autotrace-debuginfoUpgrade inkscapeUpgrade ImageMagick-docUpgrade inkscape-docsUpgrade inkscape-debuginfoUpgrade autotraceUpgrade inkscape-view | Apr 1, 2020 | Mar 30, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | May 25, 2022 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Mar 30, 2018 |
| Oracle_linux | — | Upgrade emacs-noxUpgrade ImageMagick-perlUpgrade ImageMagickUpgrade emacs-elUpgrade ImageMagick-docUpgrade emacs-terminalUpgrade ImageMagick-c++Upgrade emacs-filesystemUpgrade inkscapeUpgrade emacsUpgrade autotrace-develUpgrade inkscape-docsUpgrade autotraceUpgrade inkscape-viewUpgrade ImageMagick-develUpgrade emacs-commonUpgrade ImageMagick-c++-devel | Oct 5, 2022 | Mar 29, 2018 |
| Redhat_linux | — | Upgrade ImageMagick-develUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade ImageMagick-debuginfoUpgrade ImageMagick-c++-develUpgrade inkscape-debuginfoUpgrade autotraceNo solution existsUpgrade inkscape-docsUpgrade autotrace-debuginfoUpgrade inkscape-viewUpgrade ImageMagick-docUpgrade inkscapeUpgrade ImageMagick | Apr 1, 2020 | Mar 30, 2018 |
| Suse | — | Upgrade imagemagickUpgrade imagemagick-config-6-suseUpgrade imagemagick-develUpgrade imagemagick-config-6-upstreamUpgrade libmagickwand-6_q16-1Upgrade libmagickcore-6_q16-1Upgrade perl-perlmagickUpgrade libmagickcore-6_q16-1-32bitUpgrade libmagick-develUpgrade libmagick-6_q16-3 | Jun 30, 2018 | Mar 30, 2018 |
| Ubuntu | — | Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-3Upgrade libmagick++5Upgrade imagemagickUpgrade libmagickcore-6.q16-3-extraUpgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2Upgrade libmagick++-6.q16-7Upgrade libmagickcore5-extraUpgrade libmagickcore5 | Jun 19, 2018 | Mar 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub