CVE-2016-6823: Integer Overflow
Published Aug 16, 2016
·Updated
Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.
Affected Software
3 affected componentsFixes available
debian/imagemagick<=8:6.7.7.10-4, <=8:6.7.7.10-5
8:6.8.9.9-5+deb8u48:6.9.5.9+dfsg-1
ImageMagick<6.9.10-50
ImageMagick>=7.0.0-0<7.0.2-10
Remediation
Patch Available
Patch Available
Event History
Jan 18, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6823?
CVE-2016-6823 has a severity rating that indicates it can lead to denial of service attacks through crashes.
2
How do I fix CVE-2016-6823?
To fix CVE-2016-6823, upgrade ImageMagick to version 7.0.2-10 or higher.
3
What versions of ImageMagick are affected by CVE-2016-6823?
CVE-2016-6823 affects ImageMagick versions prior to 7.0.2-10 and several 6.x versions up to 6.9.10-50.
4
What kind of attack does CVE-2016-6823 allow?
CVE-2016-6823 allows remote attackers to execute a denial of service attack by causing crashes through crafted image dimensions.
5
Is CVE-2016-6823 related to image processing?
Yes, CVE-2016-6823 is specifically related to integer overflow in the BMP coder used in ImageMagick for image processing.