An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-c++-develUpgrade ImageMagick-docUpgrade ImageMagick-c++Upgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagick-devel | Oct 28, 2020 | Apr 30, 2019 |
| Amazon_linux | — | Upgrade php56-pecl-imagickUpgrade php72-pecl-imagickUpgrade php70-pecl-imagickUpgrade php54-pecl-imagickUpgrade php-pecl-imagickUpgrade php71-pecl-imagickUpgrade php55-pecl-imagickUpgrade ImageMagick | Jul 18, 2020 | Apr 30, 2019 |
| Centos_linux | — | Upgrade ImageMagick-debuginfoUpgrade ImageMagickUpgrade inkscape-debuginfoUpgrade ImageMagick-develUpgrade inkscape-viewUpgrade inkscapeUpgrade autotraceUpgrade ImageMagick-c++-develUpgrade ImageMagick-perlUpgrade inkscape-docsUpgrade autotrace-develUpgrade autotrace-debuginfoUpgrade ImageMagick-docUpgrade ImageMagick-c++ | Apr 1, 2020 | Apr 30, 2019 |
| Debian | — | Upgrade imagemagick | Aug 19, 2020 | Apr 30, 2019 |
| Freebsd | — | Upgrade ImageMagick6Upgrade ImageMagick7Upgrade ImageMagick7-nox11Upgrade ImageMagick6-nox11 | May 31, 2019 | May 30, 2019 |
| Huawei Euleros 2_0_sp2 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp3 | — | — | May 30, 2019 | Apr 30, 2019 |
| Huawei Euleros 2_0_sp5 | — | — | May 30, 2019 | Apr 30, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.9.40-0.175.3.32.0.1.0 on Solaris 11.3 | May 30, 2019 | Apr 30, 2019 |
| Oracle_linux | — | Upgrade ImageMagickUpgrade ImageMagick-docUpgrade emacsUpgrade emacs-filesystemUpgrade emacs-elUpgrade ImageMagick-c++-develUpgrade inkscape-docsUpgrade inkscape-viewUpgrade autotraceUpgrade ImageMagick-develUpgrade emacs-terminalUpgrade emacs-commonUpgrade emacs-noxUpgrade inkscapeUpgrade ImageMagick-c++Upgrade autotrace-develUpgrade ImageMagick-perl | Oct 5, 2022 | Apr 30, 2019 |
| Redhat_linux | — | Upgrade autotraceUpgrade ImageMagick-debuginfoUpgrade autotrace-develUpgrade ImageMagick-docUpgrade ImageMagick-c++Upgrade ImageMagickUpgrade ImageMagick-develUpgrade ImageMagick-c++-develUpgrade ImageMagick-perlUpgrade autotrace-debuginfoUpgrade inkscapeUpgrade inkscape-docsUpgrade inkscape-debuginfoUpgrade inkscape-viewNo solution exists | Apr 1, 2020 | Apr 30, 2019 |
| Suse | — | Upgrade libmagickwand-6_q16-1Upgrade libmagickcore-6_q16-1-32bitUpgrade libmagick-6_q16-3Upgrade perl-perlmagickUpgrade imagemagick-config-6-upstreamUpgrade libmagickcore-6_q16-1Upgrade imagemagick-config-6-suseUpgrade libmagick-develUpgrade imagemagick-develUpgrade imagemagick | May 22, 2019 | Apr 30, 2019 |
| Ubuntu | — | Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2-extraUpgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-5v5Upgrade libmagickwand5 (Ubuntu Pro)Upgrade libmagickcore-6.q16-6Upgrade imagemagick-common (Ubuntu Pro)Upgrade libmagick++-6.q16-7Upgrade imagemagick (Ubuntu Pro)Upgrade libmagickcore-6.q16-2Upgrade imagemagick-6.q16Upgrade libmagickcore-6.q16-6-extraUpgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickwand-dev (Ubuntu Pro)Upgrade imagemagickUpgrade libmagickcore-dev (Ubuntu Pro)Upgrade libmagick++-6.q16-8Upgrade perlmagick (Ubuntu Pro)Upgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagick++5 (Ubuntu Pro) | Jun 25, 2019 | Apr 30, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub