Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A flaw was found in ImageMagick, a free and open-source software for editing and manipulating digital images. This vulnerability occurs because ImageMagick fails to check for circular references between two Magick Scripting Language (MSL) files. A remote attacker could exploit this by providing specially crafted MSL files, leading to a stack overflow and ultimately a Denial of Service (DoS) condition, making the software unavailable.
Отчет
This MODERATE impact vulnerability in ImageMagick arises from a stack overflow when processing maliciously crafted MSL files containing circular references. Red Hat Enterprise Linux and Community Projects are affected where ImageMagick is used to process untrusted image or script files.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted or maliciously crafted MSL (Magick Scripting Language) files with ImageMagick. Implement strict input validation and sanitization for any ImageMagick operations that handle external or user-supplied content.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
6.2 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick: MSL - Stack overflow in ProcessMSLScript
Уязвимость обработчика формата MSL консольного графического редактора ImageMagick, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
6.2 Medium
CVSS3