CVE-2016-10063: Buffer Overflow
A buffer overflow vulnerability was found in ImageMagick in tiff.c file. A maliciously crafted file could cause the application to crash or have other unspecified impact.
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845198
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/2bb6941a2d557f26a2f2049ade466e118eeaab91
Other sources
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10063?
CVE-2016-10063 has been classified as a high severity vulnerability due to the potential for a buffer overflow leading to application crashes or unspecified impacts.
How do I fix CVE-2016-10063?
To resolve CVE-2016-10063, update ImageMagick to version 6.9.5 or later.
What types of systems are affected by CVE-2016-10063?
CVE-2016-10063 affects systems running versions of ImageMagick up to 6.9.5.
What could happen if CVE-2016-10063 is exploited?
If exploited, CVE-2016-10063 may lead to application crashes and potentially allow attackers to execute arbitrary code.
Are there any specific mitigations for CVE-2016-10063?
Mitigations for CVE-2016-10063 include updating to the latest version of ImageMagick and implementing security best practices such as input validation.