CVE-2015-8900: Medium severity ImageMagick vulnerability
A denial of service flaw (infinite loop) was found in the way ImageMagick processed certain HDR files:
http://seclists.org/oss-sec/2015/q1/608
Upstream issue, including a reproducer:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26929
Upstream patches:
http://trac.imagemagick.org/changeset/17845 http://trac.imagemagick.org/changeset/17846
Other sources
The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8900?
CVE-2015-8900 is classified as a high severity denial of service vulnerability.
How does CVE-2015-8900 affect ImageMagick?
CVE-2015-8900 can cause an infinite loop when ImageMagick processes certain HDR files, leading to a denial of service.
Which versions of ImageMagick are vulnerable to CVE-2015-8900?
Versions 6.0 to 6.9.3-10 and 7.0.1-0 to 7.0.5-0 of ImageMagick are vulnerable to CVE-2015-8900.
How can I mitigate CVE-2015-8900?
To mitigate CVE-2015-8900, update ImageMagick to a version that is not affected by the vulnerability.
Is there a public exploit for CVE-2015-8900?
Yes, there are details and reproducer examples available for CVE-2015-8900 in public security discussions.