CVE-2016-9830: Input Validation
A memory allocation failure was discovered in GraphicsMagick in MagickRealloc in memory.c
References:
http://seclists.org/oss-sec/2016/q4/586 https://blogs.gentoo.org/ago/2016/12/01/graphicsmagick-memory-allocation-failure-in-magickrealloc-memory-c
Other sources
The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9830?
CVE-2016-9830 has a medium severity rating due to its memory allocation failure that could lead to application crashes.
How do I fix CVE-2016-9830?
To fix CVE-2016-9830, upgrade GraphicsMagick to version 1.3.26 or later.
Which versions of GraphicsMagick are affected by CVE-2016-9830?
GraphicsMagick version 1.3.25 is vulnerable to CVE-2016-9830.
Is CVE-2016-9830 present in Debian systems?
Yes, CVE-2016-9830 affects Debian GNU/Linux version 8.0 when using the vulnerable GraphicsMagick package.
Can CVE-2016-9830 cause security issues?
CVE-2016-9830 can lead to application crashes which may be leveraged by attackers for denial of service.