Vulnerability identifier: #VU39581

Vulnerability risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-6498

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ImageMagick
Client/Desktop applications / Multimedia software
Debian Linux
Operating systems & Components / Operating system

Vendor: ImageMagick.org
Debian

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.

Mitigation
Install update from vendor's website.

Vulnerable software versions

ImageMagick: 6.9.7

Debian Linux: 6.9.7 - 9.0

---

External links
http://www.debian.org/security/2017/dsa-3808
http://www.securityfocus.com/bid/96591
http://bugs.debian.org/856878
http://github.com/ImageMagick/ImageMagick/commit/65f75a32a93ae4044c528a987a68366ecd4b46b9
http://github.com/ImageMagick/ImageMagick/pull/359

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.