CVE-2018-11251: Medium severity ImageMagick ImageMagick vulnerability

Q: What is the severity of CVE-2018-11251?

The severity of CVE-2018-11251 is medium with a CVSS score of 6.5.

Q: How does CVE-2018-11251 affect ImageMagick?

CVE-2018-11251 affects ImageMagick versions 7.0.7-23.

Q: What is the vulnerability type of CVE-2018-11251?

CVE-2018-11251 is a heap-based buffer over-read vulnerability.

Q: How can an attacker exploit CVE-2018-11251?

An attacker can exploit CVE-2018-11251 by crafting a malicious SUN image file.

Q: What is the recommended remedy for CVE-2018-11251?

The recommended remedy for CVE-2018-11251 is to update to ImageMagick version 8:6.9.10.23+dfsg-2.1+deb10u1 or later.

Published May 18, 2018

Updated

In ImageMagick 7.0.7-23 Q16 x8664 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.

Affected Software

3 affected componentsFixes available

ImageMagick ImageMagick>=7.0.7-16<7.0.7-21

ImageMagick ImageMagick=7.0.7-23

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u138:7.1.2.34+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u13Fixed in 8:7.1.2.34+dfsg1-1

Event History

May 18, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4245

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2018-11251?