CVE-2018-5685: Medium severity GraphicsMagick Graphicsmagick vulnerability
In GraphicsMagick 1.3.27, there is an infinite loop and application hang in the ReadBMPImage function (coders/bmp.c). Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4Fixed in 1.4+really1.3.45+hg17689-1 - Upgrade
Upgrade
GraphicsMagickto a version that resolves this vulnerability.Fixed in 1.3.27 - Compensating control
Mitigate denial-of-service exposure by not processing untrusted or user-supplied BMP images (especially those containing crafted bit-field mask values) until the affected GraphicsMagick version is remediated.
Event History
Frequently Asked Questions
What is the vulnerability ID for this GraphicsMagick vulnerability?
The vulnerability ID for this GraphicsMagick vulnerability is CVE-2018-5685.
What is the severity of CVE-2018-5685?
The severity of CVE-2018-5685 is medium, with a severity value of 6.5.
How does CVE-2018-5685 affect GraphicsMagick?
CVE-2018-5685 affects GraphicsMagick by causing an infinite loop and application hang in the ReadBMPImage function.
How can remote attackers exploit CVE-2018-5685?
Remote attackers can exploit CVE-2018-5685 by leveraging the vulnerability to cause a denial of service via an image file with a crafted bit-field mask value.
How can I fix the CVE-2018-5685 vulnerability?
To fix the CVE-2018-5685 vulnerability, update GraphicsMagick to version 1.4+really1.3.35-1 (or later) for Debian-based systems, or version 1.3.18-1ubuntu3.1 (or later) for Ubuntu-based systems.