CVE-2016-8682: High severity GraphicsMagick Graphicsmagick vulnerability
Multiple issues in GraphicsMagick received CVEs on oss-security mailing list.
CVE-2016-8682:
https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-stack-based-buffer-overflow-in-readsctimage-sct-c/
AddressSanitizer: stack-buffer-overflow ... READ of size 769 0x7f73e9a8399f in ReadSCTImage ... GraphicsMagick-1.3.25/coders/sct.c:126
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/0a0dfa81906d
CVE-2016-8683:
https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-memory-allocation-failure-in-readpcximage-pcx-c/
AddressSanitizer failed to allocate 0x4cd6a6000 bytes of LargeMmapAllocator 0x7ff8e887beba in ReadPCXImage ... GraphicsMagick-1.3.25/coders/pcx.c:467:16
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/b9edafd479b9
CVE-2016-8684:
https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-memory-allocation-failure-in-magickmalloc-memory-c/
AddressSanitizer failed to allocate 0x7fff03000 bytes of LargeMmapAllocator MagickMalloc ... GraphicsMagick-1.3.25/magick/memory.c:156:10 MagickMallocArray ... GraphicsMagick-1.3.25/magick/memory.c:347 ReadSGIImage ... GraphicsMagick-1.3.25/coders/sgi.c:498:19
Upstream patch:
http://hg.code.sf.net/p/graphicsmagick/code/rev/c53725cb5449
Other sources
The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8682?
CVE-2016-8682 is classified as a high severity vulnerability due to its potential for exploiting stack-based buffer overflow.
How do I fix CVE-2016-8682?
To address CVE-2016-8682, update GraphicsMagick to the latest version, specifically version 1.3.26 or later.
What versions of GraphicsMagick are affected by CVE-2016-8682?
CVE-2016-8682 affects GraphicsMagick version 1.3.25 and earlier.
What impact does CVE-2016-8682 have on systems?
CVE-2016-8682 can allow an attacker to execute arbitrary code on affected systems, potentially leading to a complete compromise.
Where can I find more information about CVE-2016-8682?
More detailed information regarding CVE-2016-8682 can be found in the security mailing lists and documentation from GraphicsMagick.