CVE-2016-10060: Medium severity ImageMagick vulnerability
An unchecked return value vulnerability was found in ImageMagick in the magick-cli.c file. A maliciously crafted file could cause the application to crash.
Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/196
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845196
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a02a046e7
Other sources
The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10060?
CVE-2016-10060 has been classified as a moderate severity vulnerability due to the potential for application crashes.
How do I fix CVE-2016-10060?
To fix CVE-2016-10060, upgrade ImageMagick to version 7.0.1 or later.
Which versions of ImageMagick are affected by CVE-2016-10060?
CVE-2016-10060 affects ImageMagick versions prior to 7.0.1 and those between 6.9.4-1 and 7.0.1-10.
What types of attacks can exploit CVE-2016-10060?
CVE-2016-10060 can be exploited by providing a maliciously crafted file that causes the application to crash.
Is there a known exploit for CVE-2016-10060?
Yes, there is a potential for exploitation of CVE-2016-10060, but no specific public exploits have been reported.