Описание
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
A flaw was found in ImageMagick. A memory leak in the Magick Image File Format (MIFF) encoder can occur when the software attempts to process an image and a memory allocation fails. This vulnerability allows an attacker to cause a denial of service (DoS) by exhausting system resources.
Отчет
Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Меры по смягчению последствий
Do not process untrusted image files with ImageMagick. The MIFF coder can be disabled in ImageMagick's policy.xml if not needed: <policy domain="coder" rights="none" pattern="MIFF"/>. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ImageMagick | Fix deferred | ||
| Red Hat Enterprise Linux 7 | ImageMagick | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
2.9 Low
CVSS3
Связанные уязвимости
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in th ...
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
EPSS
2.9 Low
CVSS3