CVE-2016-4564 The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers....
CriticalCVSS 9.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/imagemagick(Debian:12) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:13) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| debian/imagemagick(Debian:14) | < 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
| ImageMagick | <= 6.9.3-0 | No fix listed |
| ImageMagick | = 7.0.0-0 | No fix listed |
| ImageMagick | = 7.0.1-0 | No fix listed |
| ImageMagick | = 7.0.1-1 | No fix listed |
| alpine/imagemagick(Alpine:v3.2) | < 6.9.6.8-r0 | 6.9.6.8-r0 |
| alpine/imagemagick(Alpine:v3.3) | < 6.9.6.8-r0 | 6.9.6.8-r0 |
References
- Debian Security Tracker CVE-2016-4564 vendor-advisory
- www.imagemagick.org
- www.oracle.com
- github.com patch
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking