CVE-2016-5241: Medium severity GraphicsMagick Graphicsmagick vulnerability
magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.
Other sources
Two vulnerabilities were found in GraphicsMagick, both resulting in DoS.
Infinite loop caused by converting a circularly defined svg file.
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/ddc999ec896c
Arithmetic exception converting a svg file caused by a X%0 operation in magick/render.c:3800
(long) (y-fillpattern->tileinfo.y) % fillpattern->rows,
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/8d175c4edfe7
References (containing reproducers):
http://seclists.org/oss-sec/2016/q2/180
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5241?
CVE-2016-5241 has a severity rating classified under denial of service, which can result in application crashes.
How do I fix CVE-2016-5241?
To fix CVE-2016-5241, you should upgrade to GraphicsMagick version 1.3.24 or later.
What types of attacks does CVE-2016-5241 allow?
CVE-2016-5241 allows remote attackers to exploit crafted SVG files to cause a denial of service.
Which versions of GraphicsMagick are affected by CVE-2016-5241?
GraphicsMagick versions prior to 1.3.24 are affected by CVE-2016-5241.
Which operating systems are impacted by CVE-2016-5241?
CVE-2016-5241 impacts Debian GNU/Linux 8.0 and various versions of openSUSE.