Infinite loop in ImageMagick - CVE-2018-20467

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16711

Infinite loop in ImageMagick - CVE-2018-20467

Published: December 26, 2018


Vulnerability identifier: #VU16711
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20467
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in coders/bmp.c. A remote attacker can trick the victim into opening a specially crafted file, consume all available system resources and cause denial of service conditions.


Affected software

ImageMagick
Amazon Linux AMI
Ubuntu
Opensuse
imagemagick6 (Alpine package)
perlmagick (Ubuntu package)
libmagickwand5 (Ubuntu package)
libmagickwand-dev (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
imagemagick (Ubuntu package)
libmagick++-dev (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore-dev (Ubuntu package)
libmagickcore5 (Ubuntu package)
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
ImageMagick

How to mitigate CVE-2018-20467

Update to version 7.0.8-16.

ImageMagick - update to 7.0.8-16
imagemagick6 (Alpine package) - update to 6.9.10.37-r0
perlmagick (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
ImageMagick - update to 6.9.10.68-3.22

External References

Related Security Bulletins