USN-7-1: imagemagick vulnerability
A buffer overflow in imagemagick's EXIF parsing routine has been discovered in imagemagick versions prior to 6.1.0. Trying to query EXIF information of a malicious image file might result in execution of arbitrary code with the user's privileges. Since imagemagick can be used in custom printing systems, this also might lead to privilege escalation (execute code with the printer spooler's privileges). However, Ubuntu's standard printing system does not use imagemagick, thus there is no risk of privilege escalation in a standard installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7-1?
USN-7-1 is considered a critical vulnerability due to the potential for arbitrary code execution through a buffer overflow.
How do I fix USN-7-1?
To fix USN-7-1, upgrade to ImageMagick version 6.1.0 or later to mitigate the vulnerability.
What products are affected by USN-7-1?
USN-7-1 affects ImageMagick versions prior to 6.1.0, specifically libmagick6 on affected Ubuntu systems.
What are the risks associated with USN-7-1?
The primary risk associated with USN-7-1 is the execution of arbitrary code with the user's privileges, which could lead to system compromise.
How does the vulnerability in USN-7-1 occur?
The vulnerability in USN-7-1 occurs due to a buffer overflow in the EXIF parsing routine of ImageMagick when processing malicious image files.