Remote Denial of Service Vulnerability in graphicsmagick
Summary
DLA-1168-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u14. Fixed in 1.3.16-1.1+deb7u14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
graphicsmagick is a collection of image processing tools and associated libraries. It provides functionality for creating, editing, and converting images in various formats. The vulnerability affects graphicsmagick version 1.3.16-1.1+deb7u14 and earlier on Debian 7 Wheezy. This vulnerability allows an attacker to remotely trigger a denial of service by exploiting a heap-based buffer overflow in the AcquireCacheNexus function in magick/pixel_cache.c.
Vulnerability Detail
The vulnerability arises from a defect in the AcquireCacheNexus function in magick/pixel_cache.c. By supplying a specially crafted file, an attacker can trigger a heap-based buffer overflow, leading to a crash of the application. This can result in a denial of service condition, rendering the affected graphicsmagick instance unavailable. The impact of this vulnerability is limited to the availability of the graphicsmagick service and does not allow for remote code execution or privilege escalation.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
A remote denial of service vulnerability has been discovered in graphicsmagick, allowing an attacker to trigger a heap-based buffer overflow and crash the application. To mitigate this vulnerability, it is crucial to upgrade the graphicsmagick package to version 1.3.16-1.1+deb7u14 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
graphicsmagick is a collection of image processing tools and libraries used for creating, editing, and converting images in various formats.
The vulnerability allows an attacker to remotely trigger a denial of service by exploiting a heap-based buffer overflow. This can result in a crash of the graphicsmagick application, rendering it unavailable.
No, this vulnerability only allows for a denial of service condition and does not enable remote code execution or privilege escalation.
graphicsmagick version 1.3.16-1.1+deb7u14 and earlier on Debian 7 Wheezy are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the graphicsmagick package to version 1.3.16-1.1+deb7u14 or later using the package manager of the Debian 7 Wheezy distribution.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
