CVE-2016-9556 The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
MediumCVSS 5.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/imagemagick(Debian:12) | < 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
| debian/imagemagick(Debian:13) | < 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
| debian/imagemagick(Debian:14) | < 8:6.9.6.5+dfsg-1 | 8:6.9.6.5+dfsg-1 |
| ImageMagick | = 7.0.3-8 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| opensuse project leap | = 42.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-9556 vendor-advisory
- openSUSE-SU-2016:3024 third-party-advisory vendor-advisory
- DSA-3726 third-party-advisory vendor-advisory
- [oss-security] 20161122 Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) mailing-list third-party-advisory
- [oss-security] 20161201 imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) mailing-list third-party-advisory
- [oss-security] 20161202 Re: Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) mailing-list third-party-advisory
- 94492 third-party-advisory vdb-entry
- blogs.gentoo.org third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com issue-tracking patch vendor-advisory
- bugs.debian.org issue-tracking