Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in ReadSFWImage() (coders/sfw.c), when temporary file creation fails, read_info is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A flaw was found in ImageMagick, a widely used image editing and manipulation software. This vulnerability arises from a NULL pointer dereference that occurs when the software attempts to create temporary files and fails. An attacker could exploit this issue to trigger an application crash, leading to a Denial of Service (DoS).
Отчет
This MODERATE impact flaw in ImageMagick can lead to a denial of service due to a NULL pointer dereference when processing a crafted SFW image file. The vulnerability occurs if temporary file creation fails during image processing. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected by this flaw.
Меры по смягчению последствий
To reduce the risk associated with this vulnerability, avoid processing untrusted SFW image files with ImageMagick. If ImageMagick is deployed in environments where it processes untrusted input, consider implementing sandboxing or resource limits for ImageMagick processes to contain potential crashes and limit impact.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
EPSS
5.3 Medium
CVSS3