Red Hat Security AdvisoryRHSA-2016:1237
ImageMagick security update
Released 2016-06-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ImageMagick-6.7.8.9-15.el7_2, ImageMagick-c++-6.7.8.9-15.el7_2
- Red Hat Enterprise Linux Client Optional (v. 7) ImageMagick-c++-devel-6.7.8.9-15.el7_2, ImageMagick-devel-6.7.8.9-15.el7_2, ImageMagick-doc-6.7.8.9-15.el7_2 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ImageMagick-6.7.8.9-15.el7_2, ImageMagick-c++-6.7.8.9-15.el7_2, ImageMagick-c++-devel-6.7.8.9-15.el7_2 +3
- Red Hat Enterprise Linux Desktop (v. 6) ImageMagick-6.7.2.7-5.el6_8, ImageMagick-c++-6.7.2.7-5.el6_8
- Red Hat Enterprise Linux Desktop Optional (v. 6) ImageMagick-c++-6.7.2.7-5.el6_8, ImageMagick-c++-devel-6.7.2.7-5.el6_8, ImageMagick-devel-6.7.2.7-5.el6_8 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ImageMagick-6.7.2.7-5.el6_8, ImageMagick-c++-6.7.2.7-5.el6_8, ImageMagick-c++-devel-6.7.2.7-5.el6_8 +3
- Red Hat Enterprise Linux Server (v. 6) ImageMagick-6.7.2.7-5.el6_8, ImageMagick-6.7.2.7-5.el6_8.ppc, ImageMagick-c++-6.7.2.7-5.el6_8
- Red Hat Enterprise Linux Server (v. 7) ImageMagick-6.7.8.9-15.el7_2, ImageMagick-6.7.8.9-15.el7_2.ppc, ImageMagick-c++-6.7.8.9-15.el7_2 +1
- Red Hat Enterprise Linux Server Optional (v. 6) ImageMagick-c++-6.7.2.7-5.el6_8, ImageMagick-c++-6.7.2.7-5.el6_8.ppc, ImageMagick-c++-devel-6.7.2.7-5.el6_8 +5
- Red Hat Enterprise Linux Server Optional (v. 7) ImageMagick-c++-6.7.8.9-15.el7_2, ImageMagick-c++-6.7.8.9-15.el7_2.ppc, ImageMagick-c++-devel-6.7.8.9-15.el7_2 +4
- Red Hat Enterprise Linux Workstation (v. 6) ImageMagick-6.7.2.7-5.el6_8, ImageMagick-c++-6.7.2.7-5.el6_8
- Red Hat Enterprise Linux Workstation (v. 7) ImageMagick-6.7.8.9-15.el7_2, ImageMagick-c++-6.7.8.9-15.el7_2, ImageMagick-perl-6.7.8.9-15.el7_2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ImageMagick-c++-6.7.2.7-5.el6_8, ImageMagick-c++-devel-6.7.2.7-5.el6_8, ImageMagick-devel-6.7.2.7-5.el6_8 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) ImageMagick-c++-devel-6.7.8.9-15.el7_2, ImageMagick-devel-6.7.8.9-15.el7_2, ImageMagick-doc-6.7.8.9-15.el7_2
Fixes 7 records
Priority HIGH 73
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.49982 · Published 2016-06-10 · Partial fix
Priority MEDIUM 48
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03162 · Published 2017-03-15 · Fixed CWE-284
Priority MEDIUM 40
Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04566 · Published 2017-03-15 · Partial fix CWE-190
Priority LOW 34
Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02902 · Published 2017-03-15 · Partial fix
Priority LOW 29
The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined S…
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02177 · Published 2017-02-27 · Partial fix CWE-20
Priority LOW 29
The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01991 · Published 2017-03-15 · Partial fix CWE-476
Priority LOW 29
The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02112 · Published 2017-03-15 · Partial fix CWE-125
THREATIST.IORead the docs