Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. An attacker could exploit this vulnerability by providing a specially crafted malicious SVG (Scalable Vector Graphics) file. Processing this file would lead to a Denial of Service (DoS) attack, making the software unavailable to legitimate users.
Отчет
This vulnerability is rated Moderate for Red Hat. A denial of service can occur in ImageMagick when processing a specially crafted malicious SVG file. This flaw can be exploited by an attacker providing a malicious SVG file, leading to the software becoming unavailable.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted SVG files with ImageMagick. If processing untrusted SVG content is unavoidable, consider implementing sandboxing mechanisms for applications that utilize ImageMagick to limit the potential impact of a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
5.3 Medium
CVSS3