CVE-2016-10070: Buffer Overflow
An out-of-bounds read vulnerability was found in ImageMagick in mat.c file. A maliciously crafted file could cause the application to crash.
Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/131
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845246
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/b173a352397877775c51c9a0e9d59eb6ce24c455
Other sources
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10070?
CVE-2016-10070 has a medium severity rating due to its potential to cause application crashes.
How do I fix CVE-2016-10070?
To fix CVE-2016-10070, update ImageMagick to version 6.9.4 or later.
What types of software are affected by CVE-2016-10070?
CVE-2016-10070 affects several versions of ImageMagick, specifically versions prior to 6.9.4.
Can CVE-2016-10070 allow for remote exploitation?
CVE-2016-10070 does not allow for remote code execution but can cause a denial of service through application crashes.
How can I determine if my system is vulnerable to CVE-2016-10070?
You can determine if your system is vulnerable by checking if you are running an ImageMagick version earlier than 6.9.4.