Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A flaw was found in ImageMagick. A heap buffer overflow vulnerability exists when processing specially crafted YUV 4:2:2 (NoInterlace) images. A remote attacker could exploit this by providing a malicious image, leading to a denial of service (DoS) due to a write beyond the allocated buffer.
Отчет
This MODERATE impact vulnerability in ImageMagick affects Red Hat Enterprise Linux 6 ELS and 7 ELS. A heap buffer overflow occurs when processing specially crafted YUV 4:2:2 images, which could lead to denial of service or potentially arbitrary code execution. Exploitation requires an attacker to provide a malicious image file to a system using ImageMagick.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted YUV 4:2:2 image files with ImageMagick. If ImageMagick is used in automated workflows or server-side applications, consider implementing sandboxing mechanisms to limit the potential impact of processing malicious input. Ensure that ImageMagick instances are not exposed to untrusted input sources without proper validation and isolation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick has heap buffer overflow in YUV 4:2:2 decoder
Уязвимость функции ReadYUVImage() файла coders/yuv.c консольного графического редактора ImageMagick, позволяющая нарушителю выполнить произвольный код, раскрыть защищаемую информацию или вызвать отказ в обслуживании
5.3 Medium
CVSS3