CVE-2016-7524: Medium severity imagemagick vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must provide a crafted file that is processed by ImageMagick. Successful exploitation causes an out-of-bounds read and can result in denial of service.

Q: Is authentication required to exploit the vulnerability?

No. The CVSS vector indicates that no privileges are required, although user interaction is required.

Q: What is the expected impact?

The documented impact is availability loss: ImageMagick may be crashed or otherwise subjected to denial of service. No confidentiality or integrity impact is specified.

Published Feb 6, 2020

Updated

coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

Affected Software

2 affected components

ImageMagick<6.9.4-0

ImageMagick

Remediation

Patch Available

https://github.com/ImageMagick/ImageMagick/commit/97c9f438a9b3454d085895f4d1f66389fd22a0fb

Patch Available

https://github.com/ImageMagick/ImageMagick/commit/f8c318d462270b03e77f082e2a3a32867cacd3c6

Event History

Feb 6, 2020

CVE Published

via MITRE·01:37 PM

Data Sourced

via MITRE·01:37 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must provide a crafted file that is processed by ImageMagick. Successful exploitation causes an out-of-bounds read and can result in denial of service.

Is authentication required to exploit the vulnerability?

No. The CVSS vector indicates that no privileges are required, although user interaction is required.

What is the expected impact?

The documented impact is availability loss: ImageMagick may be crashed or otherwise subjected to denial of service. No confidentiality or integrity impact is specified.

Is a fix available?

Yes. A patch is available.

CVE-2016-7524: Medium severity imagemagick vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Is authentication required to exploit the vulnerability?

What is the expected impact?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Is authentication required to exploit the vulnerability?

What is the expected impact?

Is a fix available?