Vulnerability CVE-2008-1096


Published: 2008-03-05   Modified: 2012-02-12

Description:
The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function.

Vendor: Imagemagick
Product: Imagemagick 
Version:
6.2.8.3
6.2.8.2
6.2.8.1
6.2.8.0
Product: Graphicsmagick 
Version:
1.1.9
1.1.8
1.1.7
1.1.12
1.1.11
1.1.10

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10843
http://www.debian.org/security/2009/dsa-1858
http://www.mandriva.com/security/advisories?name=MDVSA-2008:099
http://www.redhat.com/support/errata/RHSA-2008-0145.html
http://www.securityfocus.com/bid/28821
http://www.securitytracker.com/id?1019880
http://www.ubuntu.com/usn/USN-681-1
https://bugzilla.redhat.com/show_bug.cgi?id=286411
https://exchange.xforce.ibmcloud.com/vulnerabilities/41194

Related CVE
CVE-2018-20467
In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVE-2018-18544
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.
CVE-2018-18025
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.
CVE-2018-18024
In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
CVE-2018-18023
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.
CVE-2018-18016
ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
CVE-2018-17967
ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c.
CVE-2018-17966
ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c.

Copyright 2019, cxsecurity.com

 

Back to Top