ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick6 | Oct 1, 2024 | Mar 30, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-docUpgrade ImageMagickUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfo | Oct 28, 2020 | Mar 30, 2018 |
| Amazon_linux | — | Upgrade php54-pecl-imagickUpgrade php56-pecl-imagickUpgrade php70-pecl-imagickUpgrade php71-pecl-imagickUpgrade php-pecl-imagickUpgrade php55-pecl-imagickUpgrade ImageMagickUpgrade php72-pecl-imagick | Jul 18, 2020 | Mar 30, 2018 |
| Centos_linux | — | Upgrade autotrace-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade inkscape-debuginfoUpgrade inkscape-viewUpgrade autotraceUpgrade ImageMagick-docUpgrade inkscape-docsUpgrade ImageMagick-c++-develUpgrade autotrace-debuginfoUpgrade ImageMagickUpgrade inkscape | Apr 1, 2020 | Mar 30, 2018 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp3 | — | — | May 25, 2022 | Mar 30, 2018 |
| Huawei Euleros 2_0_sp8 | — | — | Apr 26, 2022 | Mar 30, 2018 |
| Oracle_linux | — | Upgrade ImageMagick-c++-develUpgrade inkscape-viewUpgrade emacs-commonUpgrade ImageMagick-develUpgrade autotraceUpgrade autotrace-develUpgrade emacs-noxUpgrade ImageMagickUpgrade emacsUpgrade ImageMagick-c++Upgrade emacs-terminalUpgrade inkscape-docsUpgrade emacs-elUpgrade emacs-filesystemUpgrade inkscapeUpgrade ImageMagick-perlUpgrade ImageMagick-doc | Oct 5, 2022 | Mar 29, 2018 |
| Redhat_linux | — | Upgrade ImageMagick-docUpgrade ImageMagickUpgrade autotraceUpgrade autotrace-debuginfoUpgrade inkscapeUpgrade inkscape-debuginfoUpgrade inkscape-viewUpgrade inkscape-docsNo solution existsUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagick-c++-develUpgrade ImageMagick-perl | Apr 1, 2020 | Mar 30, 2018 |
| Suse | — | Upgrade imagemagickUpgrade imagemagick-config-6-suseUpgrade libmagickwand-6_q16-1Upgrade imagemagick-config-6-upstreamUpgrade libmagick-6_q16-3Upgrade libmagickcore-6_q16-1-32bitUpgrade imagemagick-develUpgrade libmagick-develUpgrade libmagickcore-6_q16-1Upgrade perl-perlmagick | Jun 30, 2018 | Mar 30, 2018 |
| Ubuntu | — | Upgrade libmagickcore5Upgrade libmagickcore5-extraUpgrade libmagick++-6.q16-7Upgrade imagemagickUpgrade imagemagick-6.q16Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-2-extraUpgrade libmagickcore-6.q16-3-extraUpgrade libmagick++5Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2 | Jun 19, 2018 | Mar 30, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub