CVE-2016-9556: Buffer Overflow
A heap-buffer overflow vulnerability was found in ImageMagick in IsPixelGray function in pixel-accessor.h triggered by opening a malicious image.
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/ce98a7acbcfca7f0a178f4b1e7b957e419e0cc99
References:
http://seclists.org/oss-sec/2016/q4/469
Other sources
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9556?
CVE-2016-9556 has been rated as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary code.
How do I fix CVE-2016-9556?
To mitigate CVE-2016-9556, update to the latest version of ImageMagick where the vulnerability is patched.
What software is affected by CVE-2016-9556?
CVE-2016-9556 affects ImageMagick version 7.0.3-8 and could impact systems running Debian 8.0 and openSUSE Leap 42.1.
What type of vulnerability is CVE-2016-9556?
CVE-2016-9556 is a heap-buffer overflow vulnerability that can be triggered by opening a malicious image.
Who discovered CVE-2016-9556?
CVE-2016-9556 was discovered as part of security research and disclosed in relation to vulnerabilities in ImageMagick.