ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Mar 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagickUpgrade ImageMagick-perl | Oct 28, 2020 | Mar 30, 2018 |
| Amazon_linux | — | Upgrade php55-pecl-imagickUpgrade php71-pecl-imagickUpgrade ImageMagickUpgrade php70-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php56-pecl-imagickUpgrade php54-pecl-imagick | Jul 18, 2020 | Mar 30, 2018 |
| Centos_linux | — | Upgrade ImageMagick-develUpgrade autotrace-develUpgrade ImageMagick-c++Upgrade ImageMagick-debuginfoUpgrade ImageMagick-perlUpgrade inkscapeUpgrade ImageMagick-docUpgrade autotrace-debuginfoUpgrade autotraceUpgrade ImageMagickUpgrade inkscape-viewUpgrade inkscape-debuginfoUpgrade inkscape-docsUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Mar 30, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | May 25, 2022 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Mar 30, 2018 |
| Oracle_linux | — | Upgrade ImageMagickUpgrade ImageMagick-c++Upgrade emacs-noxUpgrade emacs-terminalUpgrade ImageMagick-docUpgrade autotrace-develUpgrade inkscape-docsUpgrade ImageMagick-perlUpgrade inkscapeUpgrade emacs-filesystemUpgrade emacsUpgrade emacs-elUpgrade emacs-commonUpgrade autotraceUpgrade inkscape-viewUpgrade ImageMagick-c++-develUpgrade ImageMagick-devel | Oct 5, 2022 | Mar 29, 2018 |
| Redhat_linux | — | Upgrade autotraceUpgrade inkscape-docsUpgrade inkscape-viewUpgrade inkscape-debuginfoNo solution existsUpgrade inkscapeUpgrade autotrace-debuginfoUpgrade ImageMagickUpgrade ImageMagick-docUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade autotrace-develUpgrade ImageMagick-c++ | Apr 1, 2020 | Mar 30, 2018 |
| Suse | — | Upgrade imagemagickUpgrade imagemagick-config-6-suseUpgrade libmagickwand-6_q16-1Upgrade libmagick-develUpgrade perl-perlmagickUpgrade libmagickcore-6_q16-1Upgrade imagemagick-config-6-upstreamUpgrade imagemagick-develUpgrade libmagick-6_q16-3Upgrade libmagickcore-6_q16-1-32bit | Jun 30, 2018 | Mar 30, 2018 |
| Ubuntu | — | Upgrade libmagick++-6.q16-5v5Upgrade libmagick++5Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2Upgrade imagemagickUpgrade libmagickcore-6.q16-2-extraUpgrade imagemagick-6.q16Upgrade libmagick++-6.q16-7Upgrade libmagickcore5Upgrade libmagickcore5-extra | Jun 19, 2018 | Mar 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub