In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagickUpgrade imagemagick6 | Aug 22, 2024 | Apr 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-perlUpgrade ImageMagickUpgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade ImageMagick-doc | Oct 28, 2020 | Apr 29, 2019 |
| Amazon_linux | — | Upgrade ImageMagickUpgrade php54-pecl-imagickUpgrade php71-pecl-imagickUpgrade php55-pecl-imagickUpgrade php70-pecl-imagickUpgrade php56-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagick | Jul 18, 2020 | Apr 29, 2019 |
| Centos_linux | — | Upgrade autotrace-develUpgrade ImageMagick-c++-develUpgrade ImageMagick-perlUpgrade ImageMagick-docUpgrade ImageMagick-c++Upgrade ImageMagick-debuginfoUpgrade ImageMagick-develUpgrade inkscape-viewUpgrade inkscape-docsUpgrade autotraceUpgrade autotrace-debuginfoUpgrade inkscape-debuginfoUpgrade ImageMagickUpgrade inkscape | Apr 1, 2020 | Apr 29, 2019 |
| Debian | — | Upgrade imagemagick | May 15, 2019 | Apr 29, 2019 |
| Freebsd | — | Upgrade ImageMagick7-nox11Upgrade ImageMagick6Upgrade ImageMagick7Upgrade ImageMagick6-nox11 | May 31, 2019 | May 30, 2019 |
| Huawei Euleros 2_0_sp2 | — | — | May 30, 2019 | Apr 29, 2019 |
| Huawei Euleros 2_0_sp3 | — | — | May 30, 2019 | Apr 29, 2019 |
| Huawei Euleros 2_0_sp5 | — | — | May 30, 2019 | Apr 29, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.57-11.4.13.0.1.1.0 on Solaris 11.4 | Sep 17, 2019 | Apr 29, 2019 |
| Oracle_linux | — | Upgrade emacsUpgrade ImageMagick-perlUpgrade emacs-terminalUpgrade inkscape-docsUpgrade autotraceUpgrade inkscape-viewUpgrade inkscapeUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade emacs-filesystemUpgrade autotrace-develUpgrade ImageMagickUpgrade emacs-commonUpgrade ImageMagick-c++Upgrade emacs-elUpgrade ImageMagick-c++-develUpgrade emacs-nox | Oct 5, 2022 | Apr 8, 2019 |
| Redhat_linux | — | Upgrade inkscape-docsUpgrade inkscape-viewUpgrade ImageMagickNo solution existsUpgrade inkscape-debuginfoUpgrade autotraceUpgrade autotrace-debuginfoUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++Upgrade ImageMagick-c++-develUpgrade autotrace-develUpgrade ImageMagick-develUpgrade inkscapeUpgrade ImageMagick-perlUpgrade ImageMagick-doc | Apr 1, 2020 | Apr 29, 2019 |
| Suse | — | Upgrade imagemagick-config-6-suseUpgrade imagemagick-config-7-upstreamUpgrade libmagick-develUpgrade imagemagick-docUpgrade libmagickcore-6_q16-1Upgrade libmagickwand-7_q16hdri6Upgrade libmagick-7_q16hdri4Upgrade imagemagick-config-6-upstreamUpgrade imagemagick-devel-32bitUpgrade perl-perlmagickUpgrade imagemagick-develUpgrade libmagickcore-7_q16hdri6-32bitUpgrade imagemagickUpgrade libmagickcore-7_q16hdri6Upgrade libmagickwand-6_q16-1Upgrade libmagickwand-7_q16hdri6-32bitUpgrade libmagickcore-6_q16-1-32bitUpgrade libmagick-6_q16-3Upgrade libmagick-7_q16hdri4-32bitUpgrade imagemagick-config-7-suseUpgrade libmagick-devel-32bitUpgrade imagemagick-extra | Jun 25, 2019 | Apr 29, 2019 |
| Ubuntu | — | Upgrade libmagickcore-dev (Ubuntu Pro)Upgrade libmagickwand-dev (Ubuntu Pro)Upgrade libmagickwand5 (Ubuntu Pro)Upgrade libmagick++-6.q16-8Upgrade libmagickcore5 (Ubuntu Pro)Upgrade imagemagick (Ubuntu Pro)Upgrade libmagick++-dev (Ubuntu Pro)Upgrade libmagickcore-6.q16-6-extraUpgrade libmagick++-6.q16-7Upgrade libmagickcore-6.q16-3-extraUpgrade libmagickcore-6.q16-2Upgrade libmagickcore-6.q16-6Upgrade imagemagickUpgrade libmagick++-6.q16-5v5Upgrade libmagick++5 (Ubuntu Pro)Upgrade perlmagick (Ubuntu Pro)Upgrade imagemagick-6.q16Upgrade imagemagick-common (Ubuntu Pro)Upgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickcore-6.q16-3Upgrade libmagickcore-6.q16-2-extra | Jun 25, 2019 | Apr 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub