An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagickUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfo | Oct 28, 2020 | Apr 30, 2019 |
| Amazon_linux | — | Upgrade ImageMagickUpgrade php71-pecl-imagickUpgrade php55-pecl-imagickUpgrade php56-pecl-imagickUpgrade php70-pecl-imagickUpgrade php54-pecl-imagickUpgrade php72-pecl-imagickUpgrade php-pecl-imagick | Jul 18, 2020 | Apr 30, 2019 |
| Centos_linux | — | Upgrade ImageMagickUpgrade ImageMagick-debuginfoUpgrade inkscapeUpgrade inkscape-debuginfoUpgrade ImageMagick-develUpgrade inkscape-viewUpgrade inkscape-docsUpgrade autotrace-develUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade ImageMagick-c++-develUpgrade ImageMagick-perlUpgrade autotraceUpgrade autotrace-debuginfo | Apr 1, 2020 | Apr 30, 2019 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Apr 30, 2019 |
| Freebsd | — | Upgrade ImageMagick7Upgrade ImageMagick6Upgrade ImageMagick6-nox11Upgrade ImageMagick7-nox11 | May 31, 2019 | May 30, 2019 |
| Huawei Euleros 2_0_sp2 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp3 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp5 | — | — | May 30, 2019 | Apr 30, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.40-0.175.3.32.0.1.0 on Solaris 11.3 | May 30, 2019 | Apr 30, 2019 |
| Oracle_linux | — | Upgrade emacs-terminalUpgrade emacs-commonUpgrade ImageMagick-develUpgrade emacs-noxUpgrade inkscapeUpgrade ImageMagick-c++Upgrade ImageMagick-perlUpgrade autotrace-develUpgrade emacsUpgrade inkscape-docsUpgrade emacs-filesystemUpgrade ImageMagick-docUpgrade autotraceUpgrade ImageMagick-c++-develUpgrade emacs-elUpgrade inkscape-viewUpgrade ImageMagick | Oct 5, 2022 | Apr 30, 2019 |
| Redhat_linux | — | Upgrade autotrace-develUpgrade ImageMagickUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade autotraceUpgrade ImageMagick-debuginfoUpgrade ImageMagick-docNo solution existsUpgrade autotrace-debuginfoUpgrade inkscape-viewUpgrade inkscapeUpgrade inkscape-docsUpgrade inkscape-debuginfo | Apr 1, 2020 | Apr 30, 2019 |
| Suse | — | Upgrade libMagick++-develUpgrade libMagickCore-6_Q16-1Upgrade ImageMagick-develUpgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-SUSEUpgrade perl-PerlMagick | May 22, 2019 | Apr 30, 2019 |
| Ubuntu | — | Upgrade imagemagick-common (Ubuntu Pro)Upgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-6Upgrade libmagick++-6.q16-8Upgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickcore-6.q16-3-extraUpgrade perlmagick (Ubuntu Pro)Upgrade libmagickcore-6.q16-6-extraUpgrade libmagickwand-dev (Ubuntu Pro)Upgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagickcore-dev (Ubuntu Pro)Upgrade imagemagickUpgrade libmagick++5 (Ubuntu Pro)Upgrade libmagickcore-6.q16-2-extraUpgrade imagemagick-6.q16Upgrade libmagickwand5 (Ubuntu Pro)Upgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagickcore-6.q16-2Upgrade libmagickcore-6.q16-3Upgrade imagemagick (Ubuntu Pro)Upgrade libmagick++-6.q16-5v5 | Jun 25, 2019 | Apr 30, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub