An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagickUpgrade ImageMagick-debuginfo | Oct 28, 2020 | Apr 30, 2019 |
| Amazon_linux | — | Upgrade ImageMagickUpgrade php55-pecl-imagickUpgrade php71-pecl-imagickUpgrade php56-pecl-imagickUpgrade php70-pecl-imagickUpgrade php54-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagick | Jul 18, 2020 | Apr 30, 2019 |
| Centos_linux | — | Upgrade inkscapeUpgrade ImageMagickUpgrade inkscape-debuginfoUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade inkscape-viewUpgrade autotrace-debuginfoUpgrade autotraceUpgrade ImageMagick-docUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade inkscape-docs | Apr 1, 2020 | Apr 30, 2019 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Apr 30, 2019 |
| Freebsd | — | Upgrade ImageMagick7-nox11Upgrade ImageMagick6-nox11Upgrade ImageMagick7Upgrade ImageMagick6 | May 31, 2019 | May 30, 2019 |
| Huawei Euleros 2_0_sp2 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp3 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp5 | — | — | May 30, 2019 | Apr 30, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.40-0.175.3.32.0.1.0 on Solaris 11.3 | May 30, 2019 | Apr 30, 2019 |
| Oracle_linux | — | Upgrade emacs-noxUpgrade ImageMagick-develUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagick-perlUpgrade inkscapeUpgrade emacs-commonUpgrade emacs-terminalUpgrade ImageMagickUpgrade ImageMagick-docUpgrade inkscape-viewUpgrade emacs-filesystemUpgrade emacs-elUpgrade inkscape-docsUpgrade autotraceUpgrade ImageMagick-c++-develUpgrade emacs | Oct 5, 2022 | Apr 30, 2019 |
| Redhat_linux | — | Upgrade inkscapeNo solution existsUpgrade autotrace-debuginfoUpgrade inkscape-viewUpgrade inkscape-debuginfoUpgrade inkscape-docsUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagickUpgrade autotraceUpgrade ImageMagick-debuginfoUpgrade ImageMagick-docUpgrade autotrace-develUpgrade ImageMagick-develUpgrade ImageMagick-c++ | Apr 1, 2020 | Apr 30, 2019 |
| Suse | — | Upgrade imagemagick-develUpgrade imagemagick-config-6-suseUpgrade libmagick-develUpgrade perl-perlmagickUpgrade libmagickcore-6_q16-1Upgrade imagemagick-config-6-upstreamUpgrade imagemagickUpgrade libmagick-6_q16-3Upgrade libmagickcore-6_q16-1-32bitUpgrade libmagickwand-6_q16-1 | May 22, 2019 | Apr 30, 2019 |
| Ubuntu | — | Upgrade imagemagick (Ubuntu Pro)Upgrade libmagickcore-6.q16-2-extraUpgrade imagemagick-common (Ubuntu Pro)Upgrade libmagickcore-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-6Upgrade libmagickcore-6.q16-6-extraUpgrade perlmagick (Ubuntu Pro)Upgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16Upgrade libmagick++-6.q16-5v5Upgrade libmagickcore-6.q16-3Upgrade libmagickwand5 (Ubuntu Pro)Upgrade imagemagickUpgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagick++-6.q16-8Upgrade libmagick++5 (Ubuntu Pro)Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickwand-dev (Ubuntu Pro) | Jun 25, 2019 | Apr 30, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub