Memory leak in ImageMagick - CVE-2018-18544

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU15461

Memory leak in ImageMagick - CVE-2018-18544

Published: October 22, 2018 / Updated: October 22, 2018


Vulnerability identifier: #VU15461
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18544
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak in the WriteMSLImage function, as defined in the coders/msl.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input, trigger memory leak and cause the service to crash.


Affected software

ImageMagick
Amazon Linux AMI
Ubuntu
Opensuse
openEuler
graphicsmagick (Alpine package)
imagemagick6 (Alpine package)
imagemagick (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
GraphicsMagick-debuginfo
GraphicsMagick-c++
GraphicsMagick-devel
GraphicsMagick-debugsource
GraphicsMagick-perl
GraphicsMagick-c++-devel
GraphicsMagick-help
GraphicsMagick
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
ImageMagick

How to mitigate CVE-2018-18544

Update to version 7.0.8-14.

ImageMagick - update to 7.0.8-14
graphicsmagick (Alpine package) - update to 1.3.35-r0
imagemagick6 (Alpine package) - update to 6.9.10.37-r0
imagemagick (Ubuntu package) - addressed in versions 8:6.7.7.10-6ubuntu3.13+esm21, 8:6.8.9.9-7ubuntu5.14, 8:6.8.9.9-7ubuntu5.16+esm20, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.7.4+dfsg-16ubuntu6.15+esm12, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2, 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10, 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9, 8:7.1.2.3+dfsg1-1ubuntu0.1
libmagick++-6.q16-5v5 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.14, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-2-extra (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
GraphicsMagick-debuginfo - update to 1.3.30-9
GraphicsMagick-c++ - update to 1.3.30-9
GraphicsMagick-devel - update to 1.3.30-9
GraphicsMagick-debugsource - update to 1.3.30-9
GraphicsMagick-perl - update to 1.3.30-9
GraphicsMagick-c++-devel - update to 1.3.30-9
GraphicsMagick-help - update to 1.3.30-9
GraphicsMagick - update to 1.3.30-9
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
ImageMagick - update to 6.9.10.68-3.22

External References

Related Security Bulletins