RHSA-2008:0145: Moderate: ImageMagick security update

First published: Wed Apr 16 2008(Updated: )

ImageMagick is an image display and manipulation tool for the X Window<br>System that can read and write multiple image formats.<br>Several heap-based buffer overflow flaws were found in ImageMagick. If a<br>victim opened a specially crafted DCM or XWD file, an attacker could<br>potentially execute arbitrary code on the victim's machine. (CVE-2007-1797)<br>Several denial of service flaws were found in ImageMagick's parsing of XCF<br>and DCM files. Attempting to process a specially-crafted input file in<br>these formats could cause ImageMagick to enter an infinite loop.<br>(CVE-2007-4985)<br>Several integer overflow flaws were found in ImageMagick. If a victim<br>opened a specially-crafted DCM, DIB, XBM, XCF or XWD file, an attacker<br>could potentially execute arbitrary code with the privileges of the user<br>running ImageMagick. (CVE-2007-4986)<br>An integer overflow flaw was found in ImageMagick's DIB parsing code. If a<br>victim opened a specially-crafted DIB file, an attacker could potentially<br>execute arbitrary code with the privileges of the user running ImageMagick.<br>(CVE-2007-4988)<br>A heap-based buffer overflow flaw was found in the way ImageMagick parsed<br>XCF files. If a specially-crafted XCF image was opened, ImageMagick could<br>be made to overwrite heap memory beyond the bounds of its allocated memory.<br>This could, potentially, allow an attacker to execute arbitrary code on the<br>machine running ImageMagick. (CVE-2008-1096)<br>A heap-based buffer overflow flaw was found in ImageMagick's processing of<br>certain malformed PCX images. If a victim opened a specially-crafted PCX<br>file, an attacker could possibly execute arbitrary code on the victim's<br>machine. (CVE-2008-1097)<br>All users of ImageMagick should upgrade to these updated packages, which<br>contain backported patches to correct these issues.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2008:0145