- Description
- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- imagemagick, magick.net
CVSS 3.1
- Type
- Primary
- Base score
- 4.4
- Impact score
- 2.5
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Severity
- MEDIUM
- security-advisories@github.com
- CWE-122
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6F44A65-1733-4752-AAD0-BCCC7BDBC877",
"versionEndExcluding": "6.9.13-40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFFD439-1068-4B6F-AE01-724AC62CDCEA",
"versionEndExcluding": "7.1.2-15",
"versionStartIncluding": "7.0.0-0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dlemstra:magick.net:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F5891403-B079-4CD7-BA2A-361146A2F475",
"versionEndExcluding": "14.10.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]