CVE-2016-9559

MEDIUM

Imagemagick < 6.9.6-5 - NULL Pointer Dereference

Title source: rule

Description

coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.

References (7)

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3726

[Mailing List, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/11/19/7

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/11/23/4

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94489

[Patch, Third Party Advisory, VDB Entry] https://blogs.gentoo.org/ago/2016/11/19/imagemagick-null-pointer-must-never-be-null-tiff-c/

[Issue Tracking, Patch, Third Party Advisory] https://github.com/ImageMagick/ImageMagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b

View Patch ZIP pw:eip

[Issue Tracking, Patch, Third Party Advisory] https://github.com/ImageMagick/ImageMagick/issues/298

Scores

CVSS v3 6.5

EPSS 0.0103

EPSS Percentile 77.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-476

Status draft

Affected Products (2)

imagemagick/imagemagick < 6.9.6-5

debian/debian_linux

Timeline

Published Mar 01, 2017

Tracked Since Feb 18, 2026