ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Mar 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagickUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade ImageMagick-c++-devel | Oct 28, 2020 | Mar 30, 2018 |
| Amazon_linux | — | Upgrade php54-pecl-imagickUpgrade php56-pecl-imagickUpgrade php70-pecl-imagickUpgrade php55-pecl-imagickUpgrade php72-pecl-imagickUpgrade ImageMagickUpgrade php71-pecl-imagickUpgrade php-pecl-imagick | Jul 18, 2020 | Mar 30, 2018 |
| Centos_linux | — | Upgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade inkscape-viewUpgrade autotraceUpgrade inkscape-debuginfoUpgrade ImageMagickUpgrade ImageMagick-c++-develUpgrade inkscapeUpgrade autotrace-debuginfoUpgrade inkscape-docsUpgrade ImageMagick-doc | Apr 1, 2020 | Mar 30, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | May 25, 2022 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Mar 30, 2018 |
| Oracle_linux | — | Upgrade emacs-noxUpgrade inkscape-docsUpgrade emacsUpgrade ImageMagick-docUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade inkscapeUpgrade emacs-filesystemUpgrade autotrace-develUpgrade emacs-elUpgrade emacs-terminalUpgrade ImageMagickUpgrade ImageMagick-c++-develUpgrade inkscape-viewUpgrade autotraceUpgrade ImageMagick-develUpgrade emacs-common | Oct 5, 2022 | Mar 29, 2018 |
| Redhat_linux | — | Upgrade ImageMagick-debuginfoUpgrade ImageMagick-c++-develUpgrade ImageMagick-perlUpgrade ImageMagick-develUpgrade autotrace-develUpgrade ImageMagick-c++No solution existsUpgrade inkscape-debuginfoUpgrade autotraceUpgrade ImageMagickUpgrade ImageMagick-docUpgrade inkscape-viewUpgrade inkscape-docsUpgrade autotrace-debuginfoUpgrade inkscape | Apr 1, 2020 | Mar 30, 2018 |
| Suse | — | Upgrade ImageMagick-config-6-upstreamUpgrade perl-PerlMagickUpgrade libMagickCore-6_Q16-1Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-SUSEUpgrade libMagick++-6_Q16-3Upgrade ImageMagickUpgrade libMagick++-devel | Jun 30, 2018 | Mar 30, 2018 |
| Ubuntu | — | Upgrade libmagickcore5Upgrade libmagick++-6.q16-7Upgrade libmagickcore5-extraUpgrade libmagickcore-6.q16-3Upgrade imagemagick-6.q16Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2Upgrade imagemagickUpgrade libmagick++5Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-2-extra | Jun 19, 2018 | Mar 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub