CVE-2016-10071: Medium severity ImageMagick vulnerability
An out-of-bounds read vulnerability was found in ImageMagick in mat.c file. A maliciously crafted file could cause the application to crash.
Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/131
References:
http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845246
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/f3b483e8b054c50149912523b4773687e18afe25
Other sources
coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10071?
CVE-2016-10071 is classified as a medium severity vulnerability that can lead to application crashes.
How do I fix CVE-2016-10071?
To fix CVE-2016-10071, upgrade ImageMagick to version 6.9.4 or later.
What types of attack is CVE-2016-10071 associated with?
CVE-2016-10071 is associated with remote code execution attacks via out-of-bounds read vulnerabilities.
Which version of ImageMagick is vulnerable to CVE-2016-10071?
Versions of ImageMagick prior to 6.9.4 are vulnerable to CVE-2016-10071.
Is CVE-2016-10071 easy to exploit?
Yes, CVE-2016-10071 can be easily exploited by attackers using specially crafted files.