Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with IPTCTEXT. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
A flaw was found in ImageMagick. A local attacker could provide a crafted image profile containing invalid IPTC (International Press Telecommunications Council) data. When ImageMagick attempts to write this data using the IPTCTEXT function, it may lead to an infinite loop, resulting in a Denial of Service (DoS) for the application.
Отчет
This MODERATE impact flaw in ImageMagick can lead to a denial of service. A crafted profile containing invalid IPTC data may cause an infinite loop when ImageMagick attempts to write it with IPTCTEXT. Red Hat Enterprise Linux systems utilizing ImageMagick to process untrusted image files are affected.
Меры по смягчению последствий
To mitigate this issue, restrict ImageMagick's processing of untrusted image files. If ImageMagick is used in an automated or server-side context, consider implementing sandboxing mechanisms to limit the resources available to the ImageMagick process when handling external input. This can help contain the impact of a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile
EPSS
6.2 Medium
CVSS3