Input validation error in ImageMagick - CVE-2018-16644
Published: October 14, 2018
Vulnerability identifier: #VU15352
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16644
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient check for length in ReadDCMImage() function in coders/dcm.c and in ReadPICTImage() function in coders/pict.c. A remote attacker can pass a specially crafted image to the affected application and trigger application crash.
Affected software
ImageMagick
imagemagick (Debian package)
imagemagick6 (Alpine package)
SUSE Linux
Opensuse
imagemagick (Debian package)
imagemagick6 (Alpine package)
SUSE Linux
Opensuse
How to mitigate CVE-2018-16644
Install updates from vendor's website.
ImageMagick - update to 7.0.8-12
imagemagick6 (Alpine package) - update to 6.9.10.37-r0
imagemagick6 (Alpine package) - update to 6.9.10.37-r0
External References
- https://github.com/ImageMagick/ImageMagick/commit/16916c8979c32765c542e216b31cee2671b7afe7
- https://github.com/ImageMagick/ImageMagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135
- https://github.com/ImageMagick/ImageMagick/issues/1269
- https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html
- https://usn.ubuntu.com/3785-1/
Related Security Bulletins
- Debian update for imagemagick
- OpenSUSE Linux update for ImageMagick
- OpenSUSE Linux update for ImageMagick
- OpenSUSE Linux update for GraphicsMagick
- OpenSUSE Linux update for GraphicsMagick
- OpenSUSE Linux update for ImageMagick
- Input validation error in imagemagick6 (Alpine package)
- OpenSUSE Linux update for ImageMagick