CVE-2016-5688

HIGH

ImageMagick <6.9.4-4,7.x <7.0.1-5 - Buffer Overflow

Title source: llm
STIX 2.1

Description

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.

References (9)

Core 9
Core References
Patch, Vendor Advisory x_refsource_confirm
https://github.com/ImageMagick/ImageMagick/commits/7.0.1-5
Patch, Vendor Advisory x_refsource_confirm
https://github.com/ImageMagick/ImageMagick/commits/6.9.4-4
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91283
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/06/17/3
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/06/14/5

Scores

CVSS v3 8.1
EPSS 0.0224
EPSS Percentile 84.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (7)
imagemagick/imagemagick 7.0.1-0
imagemagick/imagemagick 7.0.1-1
imagemagick/imagemagick 7.0.1-2
imagemagick/imagemagick 7.0.1-3
imagemagick/imagemagick 7.0.1-4
imagemagick/imagemagick < 6.9.4-3
oracle/solaris 11.3
Published Dec 13, 2016
Tracked Since Feb 18, 2026