CVE-2012-0247: Input Validation
Published Jun 5, 2012
·Updated
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.
Affected Software
17 affected components
ImageMagick ImageMagick<=6.7.5-7
Debian Debian Linux=6.0
Debian Debian Linux=7.0
Canonical Ubuntu Linux=10.04
Canonical Ubuntu Linux=11.04
Canonical Ubuntu Linux=11.10
Canonical Ubuntu Linux=12.04
redhat Storage=2.0
redhat Enterprise Linux Desktop=5.0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Eus=6.2
redhat Enterprise Linux Server=5.0
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server Aus=6.2
redhat Enterprise Linux Server Eus=6.2
redhat Enterprise Linux Workstation=5.0
redhat Enterprise Linux Workstation=6.0
Remediation
Event History
Jun 5, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0247?
CVE-2012-0247 has a severity rating that indicates a denial of service and potential for arbitrary code execution.
2
How do I fix CVE-2012-0247?
To fix CVE-2012-0247, update ImageMagick to a version later than 6.7.5-7.
3
What types of attacks can CVE-2012-0247 facilitate?
CVE-2012-0247 can facilitate denial of service attacks and may allow attackers to execute arbitrary code.
4
Which software versions are affected by CVE-2012-0247?
CVE-2012-0247 affects ImageMagick version 6.7.5-7 and earlier, as well as specific versions of Debian and Ubuntu Linux.
5
Is CVE-2012-0247 exploitable remotely?
Yes, CVE-2012-0247 can be exploited by remote attackers through crafted images.