CVE-2016-5240: Input Validation
A vulnerability was found in ImageMagick. Conversion of a circularly defined svg file could cause the application to go into infinite loop.
References:
http://seclists.org/oss-sec/2016/q2/182
Other sources
The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5240?
CVE-2016-5240 is classified as a denial of service vulnerability.
How do I fix CVE-2016-5240?
To fix CVE-2016-5240, upgrade GraphicsMagick to version 1.3.24 or later.
What type of attacks can CVE-2016-5240 be exploited for?
CVE-2016-5240 can be exploited by remote attackers to create an infinite loop leading to denial of service.
Which software versions are affected by CVE-2016-5240?
CVE-2016-5240 affects GraphicsMagick versions prior to 1.3.24.
Is CVE-2016-5240 present in ImageMagick as well?
Yes, CVE-2016-5240 is also present in the SVG renderer in ImageMagick.