CVE-2018-16328: Null Pointer Dereference

Reference Links

• https://github.com/ImageMagick/ImageMagick/issues/1224
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1624956
• https://github.com/ImageMagick/ImageMagick/commit/107ce8577e818cf4801e5a59641cb769d645cc95
• https://access.redhat.com/errata/RHSA-2020:1180
• https://access.redhat.com/security/cve/cve-2018-16328
• https://bugzilla.redhat.com/show_bug.cgi?id=1624955
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149251
• https://www.ibm.com/support/pages/node/6335281 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6335281

Frequently Asked Questions

• What is the severity of CVE-2018-16328?

  CVE-2018-16328 has a medium severity rating due to its potential to cause denial of service.

• How do I fix CVE-2018-16328?

  To fix CVE-2018-16328, update ImageMagick to a version later than 7.0.8-8.

• What impact does CVE-2018-16328 have on affected systems?

  CVE-2018-16328 can cause affected systems running ImageMagick to crash when processing a specially-crafted file.

• Which versions of ImageMagick are affected by CVE-2018-16328?

  CVE-2018-16328 affects ImageMagick versions up to and including 7.0.8-8.

• Can CVE-2018-16328 be exploited remotely?

  Yes, CVE-2018-16328 can be exploited remotely if a victim is persuaded to open a malicious file in ImageMagick.