First published: Thu Jan 05 2017(Updated: )
An unchecked return value vulnerability was found in ImageMagick in the magick-cli.c file. A maliciously crafted file could cause the application to crash. Upstream bug: <a href="https://github.com/ImageMagick/ImageMagick/issues/196">https://github.com/ImageMagick/ImageMagick/issues/196</a> References: <a href="http://seclists.org/oss-sec/2016/q4/758">http://seclists.org/oss-sec/2016/q4/758</a> <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845196">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845196</a> Upstream patch: <a href="https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a02a046e7">https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a02a046e7</a>
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/ImageMagick | <7.0.1 | 7.0.1 |
ImageMagick | <6.9.4-1 | |
ImageMagick | >=7.0.0-0<7.0.1-10 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-10060 has been classified as a moderate severity vulnerability due to the potential for application crashes.
To fix CVE-2016-10060, upgrade ImageMagick to version 7.0.1 or later.
CVE-2016-10060 affects ImageMagick versions prior to 7.0.1 and those between 6.9.4-1 and 7.0.1-10.
CVE-2016-10060 can be exploited by providing a maliciously crafted file that causes the application to crash.
Yes, there is a potential for exploitation of CVE-2016-10060, but no specific public exploits have been reported.