An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagick | Oct 28, 2020 | Apr 30, 2019 |
| Amazon_linux | — | Upgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php56-pecl-imagickUpgrade php70-pecl-imagickUpgrade php54-pecl-imagickUpgrade ImageMagickUpgrade php71-pecl-imagickUpgrade php55-pecl-imagick | Jul 18, 2020 | Apr 30, 2019 |
| Centos_linux | — | Upgrade ImageMagickUpgrade inkscape-debuginfoUpgrade inkscapeUpgrade inkscape-viewUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade inkscape-docsUpgrade autotraceUpgrade autotrace-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Apr 30, 2019 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Apr 30, 2019 |
| Freebsd | — | Upgrade ImageMagick7Upgrade ImageMagick6-nox11Upgrade ImageMagick7-nox11Upgrade ImageMagick6 | May 31, 2019 | May 30, 2019 |
| Huawei Euleros 2_0_sp2 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp3 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp5 | — | — | May 30, 2019 | Apr 30, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.40-0.175.3.32.0.1.0 on Solaris 11.3 | May 30, 2019 | Apr 30, 2019 |
| Oracle_linux | — | Upgrade inkscapeUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade emacs-terminalUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade emacs-commonUpgrade emacs-noxUpgrade emacs-elUpgrade autotraceUpgrade ImageMagickUpgrade emacsUpgrade inkscape-docsUpgrade inkscape-viewUpgrade emacs-filesystemUpgrade ImageMagick-c++-develUpgrade ImageMagick-doc | Oct 5, 2022 | Apr 30, 2019 |
| Redhat_linux | — | Upgrade autotrace-debuginfoUpgrade inkscape-docsUpgrade inkscapeUpgrade inkscape-debuginfoUpgrade inkscape-viewNo solution existsUpgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-docUpgrade ImageMagickUpgrade autotraceUpgrade autotrace-develUpgrade ImageMagick-c++Upgrade ImageMagick-perlUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Apr 30, 2019 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagick++-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade ImageMagickUpgrade ImageMagick-config-6-SUSEUpgrade libMagickWand-6_Q16-1Upgrade perl-PerlMagick | May 22, 2019 | Apr 30, 2019 |
| Ubuntu | — | Upgrade perlmagick (Ubuntu Pro)Upgrade libmagickwand-dev (Ubuntu Pro)Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-6-extraUpgrade libmagickcore-dev (Ubuntu Pro)Upgrade imagemagickUpgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagick++5 (Ubuntu Pro)Upgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagick++-6.q16-8Upgrade libmagickwand5 (Ubuntu Pro)Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-6Upgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-6.q16-5v5Upgrade imagemagick (Ubuntu Pro)Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2Upgrade imagemagick-common (Ubuntu Pro) | Jun 25, 2019 | Apr 30, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub