GHSA-6p6q-wfrv-ffhh: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected ImageMagick versions are exposed when they use the X11 animate operation to open a crafted image. The issue requires user interaction; it is not described as affecting ordinary image processing without that operation.
What does an attacker need to do to exploit it?
An attacker needs to provide a maliciously crafted image and have a user run the X11 animate operation on that image. No attacker privileges are required, but user interaction is required.
What versions should be remediated?
Update ImageMagick 6.x to 6.9.13-58 or later, or ImageMagick 7.x to 7.1.2-33 or later. Versions before those releases are affected.
What can be done if an update cannot be applied immediately?
Avoid using the X11 animate operation on untrusted images until an update is available. Limit access to potentially malicious image files for users who run that operation.