CVE-2007-4987: Critical severity ImageMagick vulnerability
Published Sep 24, 2007
·Updated
Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.
Affected Software
57 affected components
ImageMagick=5.3.3
ImageMagick=5.3.8
ImageMagick=5.4.2.3
ImageMagick=5.4.3
ImageMagick=5.4.4.5
ImageMagick=5.4.7
ImageMagick=5.4.8
ImageMagick=5.4.8.2_1.1.0
ImageMagick=5.5.3_.2_1.2.0
ImageMagick=5.5.4
ImageMagick=5.5.6
ImageMagick=5.5.6.0_20030409
ImageMagick=5.5.7
ImageMagick=5.5.7.15
ImageMagick=6.0
ImageMagick=6.0.1
ImageMagick=6.0.2
ImageMagick=6.0.2.5
ImageMagick=6.0.3
ImageMagick=6.0.4
ImageMagick=6.0.4.4
ImageMagick=6.0.5
ImageMagick=6.0.6
ImageMagick=6.0.6.2
ImageMagick=6.0.7
ImageMagick=6.0.8
ImageMagick=6.1
ImageMagick=6.1.1
ImageMagick=6.1.2
ImageMagick=6.1.3
ImageMagick=6.1.4
ImageMagick=6.1.5
ImageMagick=6.1.6
ImageMagick=6.1.7
ImageMagick=6.1.8
ImageMagick=6.2
ImageMagick=6.2.0.3
ImageMagick=6.2.0.7
ImageMagick=6.2.1
ImageMagick=6.2.2
ImageMagick=6.2.3
ImageMagick=6.2.3.4
ImageMagick=6.2.4
ImageMagick=6.2.4.3
ImageMagick=6.2.4.5
ImageMagick=6.2.5
ImageMagick=6.2.6
ImageMagick=6.2.7
ImageMagick=6.2.8
ImageMagick=6.2.9
ImageMagick=6.2.9.2
ImageMagick=6.3.1
ImageMagick=6.3.2
ImageMagick=6.3.3_3
ImageMagick=6.3.3_5
ImageMagick=6.3.3_6
ImageMagick=6.3.4
Remediation
Patch Available
Event History
Sep 24, 2007
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-4987?
CVE-2007-4987 has a CVSS score that indicates a critical vulnerability allowing arbitrary code execution.
2
How do I fix CVE-2007-4987?
To fix CVE-2007-4987, upgrade your ImageMagick installation to version 6.3.5-9 or later.
3
What versions of ImageMagick are affected by CVE-2007-4987?
CVE-2007-4987 affects multiple versions of ImageMagick prior to version 6.3.5-9.
4
Can CVE-2007-4987 be exploited remotely?
Yes, CVE-2007-4987 can be exploited remotely through a crafted image file sent to the vulnerable application.
5
What kind of attacks can CVE-2007-4987 enable?
CVE-2007-4987 can enable attackers to execute arbitrary code on affected systems.