Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.
A flaw was found in ImageMagick. Processing a specially crafted image with the -bilateral-blur operation in the BilateralBlurImage function can cause a heap-based buffer over-read due to an incorrect conversion, leading to a denial of service.
Отчет
To exploit this flaw, an attacker needs to convince a user to process a specially crafted image with the -bilateral-blur operation. Additionally, this issue can cause a heap-based buffer over-read of only 4 bytes, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.
Меры по смягчению последствий
To reduce the risk of exploitation, avoid processing untrusted image files using the -bilateral-blur operation with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Fix deferred | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, BilateralBlurImage contains a heap buffer over-read caused by an incorrect conversion. When processing a crafted image with the -bilateral-blur operation an out of bounds read can occur. This vulnerability is fixed in 7.1.2-16.
ImageMagick is free and open-source software used for editing and mani ...
ImageMagick has Heap Buffer Over-Read in BilateralBlurImage
EPSS
5.5 Medium
CVSS3