Описание
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
A vulnerability in the ImageMagick image processing tool could allow an attacker to crash the application or access sensitive information by uploading a maliciously crafted Photoshop (PSB) file.
Отчет
A vulnerability in ImageMagick allows attackers to crash the application or expose sensitive data by uploading a corrupted Photoshop (PSB) file. If your system does not process untrusted PSB files, you are not impacted.
Меры по смягчению последствий
To reduce the risk, avoid processing untrusted PSB (Photoshop Big) files with ImageMagick. Implement strict input validation for any applications that use ImageMagick to process user-supplied image files. Additionally, consider sandboxing ImageMagick processes to limit potential impact from successful exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Out of support scope | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
4.2 Medium
CVSS3
Связанные уязвимости
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an int ...
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.
Уязвимость консольного графического редактора ImageMagick, связанная с чтением за границами буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
4.2 Medium
CVSS3