DSA-4074: -1 imagemagick -- security update

Published Dec 28, 2017

Updated

imagemagick - security update

Other sources

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed image files are processed.

Affected Software

2 affected components

debian/imagemagick

Event History

Dec 28, 2017

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What needs to happen for these issues to be exploited?

A vulnerable ImageMagick installation must process a malformed image file. The reported impact includes denial of service, memory disclosure, and possible arbitrary code execution.

Which systems are exposed?

Systems using the Debian imagemagick package are in scope. Exposure depends on whether ImageMagick processes image files that could be malformed.

What should be prioritized if immediate patching is not possible?

Prioritize limiting or avoiding processing of untrusted image files with ImageMagick until the security update can be applied. This reduces the opportunity for malformed image files to trigger the affected memory-handling and input-sanitization flaws.

DSA-4074: -1 imagemagick -- security update

Other sources

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What needs to happen for these issues to be exploited?

Which systems are exposed?

What should be prioritized if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

What needs to happen for these issues to be exploited?

Which systems are exposed?

What should be prioritized if immediate patching is not possible?