CVE-2015-8896: Buffer Overflow
An integer truncation flaw leading to a heap-based buffer overflow was found in ImageMagick in pict.c.
Detailed stacktrace with reproducer can be found here:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1448803
Upstream patch for the pict.c problem is a subsection (the pict.c part) of the following commit: https://github.com/ImageMagick/ImageMagick/commit/0f6fc2d5bf8f500820c3dbcf0d23ee14f2d9f734
CVE request:
http://seclists.org/oss-sec/2015/q4/45
Other sources
Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8896?
CVE-2015-8896 has a high severity rating due to the potential for a heap-based buffer overflow.
How do I fix CVE-2015-8896?
To fix CVE-2015-8896, upgrade ImageMagick to version 6.9.4-0 or later, or to a version between 7.0.0-0 and 7.0.5-0.
What systems are affected by CVE-2015-8896?
CVE-2015-8896 affects various versions of ImageMagick and several distributions including Oracle Linux and Red Hat Enterprise Linux.
What type of vulnerability is CVE-2015-8896?
CVE-2015-8896 is an integer truncation flaw that leads to a heap-based buffer overflow.
Is CVE-2015-8896 exploitative in nature?
Yes, CVE-2015-8896 can be exploited by attackers to execute arbitrary code or cause a denial of service.