GHSA-pwpf-8799-94cj: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ImageMagick versions earlier than 6.9.13-58 and 7.x versions earlier than 7.1.2-33 are affected when they decode bzip2-compressed images.
What does an attacker need to exploit this issue?
An attacker needs the ability to provide a crafted image that uses bzip2 compression to a vulnerable ImageMagick decoding operation. The supplied CVSS vector indicates network attackability, low attack complexity, low privileges, and no user interaction.
What is the impact of successful exploitation?
The crafted image can trigger a stack-based buffer overflow while it is decoded, overwriting stack memory. This can cause crashes or memory corruption, with high integrity and availability impact in the supplied severity vector.
How can I determine whether I need to remediate?
Identify the installed ImageMagick version and determine whether the deployment processes bzip2-compressed images. Remediate if the version is below 6.9.13-58 on the 6.x branch or below 7.1.2-33 on the 7.x branch.