CVE-2016-10065: High severity ImageMagick ImageMagick vulnerability
An out of bounds read vulnerability was found in ImageMagick. A maliciously crafted file could cause the application to crash or have other unspecified impact.
Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/129
References:
http://seclists.org/oss-sec/2016/q4/758
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/134463b926fa965571aa4febd61b810be5e7da05
Other sources
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10065?
CVE-2016-10065 is classified as a medium severity vulnerability due to the potential for application crashes and unspecified impacts.
How do I fix CVE-2016-10065?
To fix CVE-2016-10065, upgrade ImageMagick to version 7.0.1 or later for Red Hat or ensure versions are updated accordingly for other affected distributions.
What versions of ImageMagick are affected by CVE-2016-10065?
CVE-2016-10065 affects ImageMagick versions prior to 6.9.7-10 and any version below 7.0.1.
Can CVE-2016-10065 be exploited remotely?
Yes, a remote attacker can exploit CVE-2016-10065 by crafting a malicious file to trigger the vulnerability.
What are the potential impacts of CVE-2016-10065?
The potential impacts of CVE-2016-10065 include application crashes and other unspecified issues that may compromise system stability.