Buffer overflow in ImageMagick - CVE-2013-4298
Published: September 10, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42593
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4298
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.
Affected software
ImageMagick
How to mitigate CVE-2013-4298
Install update from vendor's website.
External References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721273
- http://secunia.com/advisories/54581
- http://secunia.com/advisories/54671
- http://www.debian.org/security/2013/dsa-2750
- http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921
- http://www.imagemagick.org/script/changelog.php
- http://www.ubuntu.com/usn/USN-1949-1
- https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248