Ubuntu update for imagemagick
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 10 |
| CVE-ID | CVE-2018-18025 CVE-2018-17966 CVE-2018-16412 CVE-2018-16413 CVE-2018-18024 CVE-2018-18016 CVE-2018-20467 CVE-2017-12806 CVE-2017-12805 CVE-2017-13144 |
| CWE-ID | CWE-125 CWE-401 CWE-835 CWE-400 CWE-20 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #7 is available. Public exploit code for vulnerability #9 is available. |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system libmagick++5 (Ubuntu package) Operating systems & Components / Operating system package or component libmagickcore5-extra (Ubuntu package) Operating systems & Components / Operating system package or component libmagickwand5 (Ubuntu package) Operating systems & Components / Operating system package or component libmagickcore5 (Ubuntu package) Operating systems & Components / Operating system package or component libmagickcore-dev (Ubuntu package) Operating systems & Components / Operating system package or component imagemagick (Ubuntu package) Operating systems & Components / Operating system package or component perlmagick (Ubuntu package) Operating systems & Components / Operating system package or component libmagick++-dev (Ubuntu package) Operating systems & Components / Operating system package or component libmagickwand-dev (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 10 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU33485
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2018-18025
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file. A remote attacker can perform a denial of service attack.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Memory leak
EUVDB-ID: #VU15565
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-17966
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the function WritePDBImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted file.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Buffer over-read
EUVDB-ID: #VU15350
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-16412
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function. A remote attacker can perform a denial of service attack.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer over-read
EUVDB-ID: #VU15166
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-16413
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a heap-based buffer over-read in the MagickCore/quantum-private.h in PushShortPixel() function when called from the coders/psd.c ParseImageResourceBlocks() function. A remote attacker can perform a denial of service attack with a specially crafted image file.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Infinite loop
EUVDB-ID: #VU15567
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-18024
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the function ReadBMPImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted bmp file.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Memory leak
EUVDB-ID: #VU15566
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-18016
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the function WritePCXImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted file.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Infinite loop
EUVDB-ID: #VU16711
Risk: Low
CVSSv4.0: 1.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2018-20467
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in coders/bmp.c. A remote attacker can trick the victim into opening a specially crafted file, consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
8) Resource exhaustion
EUVDB-ID: #VU19048
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-12806
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory exhaustion when processing images within the format8BIM() function. A remote attacker can create a specially crafted image, pass it to the affected application and consume all available memory on the system.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Resource exhaustion
EUVDB-ID: #VU19188
Risk: Medium
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2017-12805
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a memory consumption condition in the "ReadTIFFImage()" function. A remote attacker can send a specially crafted file to the targeted system, trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
10) Input validation error
EUVDB-ID: #VU61502
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2017-13144
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in ImageMagick. A remote attacker can pass specially crafted image to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package imagemagick to the latest version.
Vulnerable software versionsUbuntu: 14.04
libmagick++5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickcore-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
imagemagick (Ubuntu package): before Ubuntu Pro (Infra-only)
perlmagick (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
libmagickwand-dev (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_5_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5-extra:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore5:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickcore-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:imagemagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:perlmagick_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagick_plus_plus_-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:libmagickwand-dev_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-6980-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
