SB2017032210 - Multiple vulnerabilities in ImageMagick

Security Bulletin ID SB2017032210

Severity

High

Patch available

YES

Number of vulnerabilities 8

Exploitation vector Remote access

Highest impact Code execution

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2014-9832)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.

2) Buffer overflow (CVE-ID: CVE-2014-9833)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.

3) Buffer overflow (CVE-ID: CVE-2014-9834)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.

4) Buffer overflow (CVE-ID: CVE-2014-9835)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.

5) Buffer overflow (CVE-ID: CVE-2014-9836)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service via a crafted xpm file.

6) Input validation error (CVE-ID: CVE-2014-9838)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash).

7) Buffer overflow (CVE-ID: CVE-2014-9839)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access).

8) Buffer overflow (CVE-ID: CVE-2014-9840)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file.

Install update from vendor's website.