Vulnerability CVE-2014-9848


Published: 2017-03-20   Modified: 2017-03-22

Description:
Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).

Vendor: Opensuse project
Product: LEAP 
Version: 42.2; 42.1;
Product: Opensuse 
Version: 13.2;
Product: Suse linux enterprise server for raspberry pi 
Version: 12.0;
Product: Suse linux enterprise software development kit 
Version: 12.0;
Product: Suse linux enterprise server 
Version: 12.0;
Product: Suse linux enterprise desktop 
Version: 12.0;
Product: Suse linux enterprise workstation extension 
Version: 12.0;
Vendor: Canonical
Product: Ubuntu linux 
Version:
16.10
16.04
14.04
12.04
Vendor: Imagemagick
Product: Imagemagick 

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial

 References:
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00093.html
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00006.html
http://www.openwall.com/lists/oss-security/2016/06/02/13
http://www.ubuntu.com/usn/USN-3131-1
https://bugzilla.redhat.com/show_bug.cgi?id=1343507

Related CVE
CVE-2016-9556
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
CVE-2016-10057
Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or other unspecified impact via a crafted file.
CVE-2016-10058
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
CVE-2016-10059
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or unspecified other impact via a crafted TIFF file.
CVE-2016-10055
Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or other unspecified impact via a crafted file.
CVE-2016-10056
Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or other unspecified impact via a crafted file.
CVE-2016-10051
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or other unspecified impact via a crafted file.
CVE-2016-10052
Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or other unspecified impact via a crafted file.

Copyright 2017, cxsecurity.com