CVE-2016-10061: Medium severity ImageMagick vulnerability
An unchecked return value vulnerability was found in ImageMagick in the tiff.c file. A maliciously crafted file could cause the application to crash.
Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/196
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845196
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/4e914bbe371433f0590cefdf3bd5f3a5710069f9
Other sources
The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10061?
CVE-2016-10061 has a medium severity level as it can cause application crashes due to an unchecked return value.
How do I fix CVE-2016-10061?
To fix CVE-2016-10061, upgrade ImageMagick to version 7.0.1 or later.
Which versions of ImageMagick are affected by CVE-2016-10061?
CVE-2016-10061 affects ImageMagick versions before 7.0.1 and including versions up to 6.9.4-8.
What type of vulnerability is CVE-2016-10061?
CVE-2016-10061 is an unchecked return value vulnerability that may lead to application crashes.
Where can I find more information about CVE-2016-10061?
Additional information about CVE-2016-10061 can be found in the ImageMagick GitHub issue tracker and various security advisories.