ID CVE-2016-5010
Summary coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.
References
Vulnerable Configurations
  • ImageMagick 6.9.5-2
    cpe:2.3:a:imagemagick:imagemagick:6.9.5-2
CVSS
Base: 4.3 (as of 08-05-2017 - 17:57)
Impact:
Exploitability:
CWE CWE-125
CAPEC
  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201611-21.NASL
    description The remote host is affected by the vulnerability described in GLSA-201611-21 (ImageMagick: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2016-12-21
    plugin id 95420
    published 2016-12-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95420
    title GLSA-201611-21 : ImageMagick: Multiple vulnerabilities (ImageTragick)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1016.NASL
    description This update for ImageMagick fixes the following issues : - security update : - CVE-2016-6520: buffer overflow [bsc#991872] - CVE-2016-5010: Out-of-bounds read in CopyMagickMemory [bsc#991444] - CVE-2016-6491: Out-of-bounds read when processing crafted tiff files [bsc#991445] This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2019-02-21
    modified 2016-12-21
    plugin id 93105
    published 2016-08-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93105
    title openSUSE Security Update : ImageMagick (openSUSE-2016-1016)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2076-1.NASL
    description This update for ImageMagick fixes the following issues : - security update : - CVE-2016-6520: buffer overflow [bsc#991872] - CVE-2016-5010: Out-of-bounds read in CopyMagickMemory [bsc#991444] - CVE-2016-6491: Out-of-bounds read when processing crafted tiff files [bsc#991445] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 93291
    published 2016-09-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93291
    title SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2016:2076-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-983.NASL
    description This update for ImageMagick fixes the following issues : - security update : - CVE-2016-6520: buffer overflow [bsc#991872] - CVE-2016-5010: Out-of-bounds read in CopyMagickMemory [bsc#991444] - CVE-2016-6491: Out-of-bounds read when processing crafted tiff files [bsc#991445]
    last seen 2019-02-21
    modified 2016-12-21
    plugin id 92980
    published 2016-08-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92980
    title openSUSE Security Update : ImageMagick (openSUSE-2016-983)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1116.NASL
    description According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.(CVE-2015-8959) - coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.(CVE-2016-5010) - The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.(CVE-2016-7522) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.(CVE-2016-7532) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.(CVE-2016-7535) - MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.(CVE-2016-7537) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.(CVE-2016-7538) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 101849
    published 2017-07-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101849
    title EulerOS 2.0 SP1 : ImageMagick (EulerOS-SA-2017-1116)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1112.NASL
    description According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.(CVE-2015-8959) - coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file.(CVE-2016-5010) - The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.(CVE-2016-7522) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.(CVE-2016-7535) - MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.(CVE-2016-7537) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.(CVE-2016-7538) - coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.(CVE-2016-7532) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 100814
    published 2017-06-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100814
    title EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2017-1112)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3652.NASL
    description This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM, EXIF, RGF or BMP files are processed.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 93115
    published 2016-08-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93115
    title Debian DSA-3652-1 : imagemagick - security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3131-1.NASL
    description It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 95053
    published 2016-11-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95053
    title Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : imagemagick vulnerabilities (USN-3131-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-3A568ADB31.NASL
    description Many security fixes, bug fixes, and other changes from the previous version 6.9.3.0. See the [6.9 branch ChangeLog](https://github.com/ImageMagick/ImageMagick/blob/3fd358e2ac3 4977fda38a2cf4d88a1cb4dd2d7c7/ChangeLog). Dependent packages are mostly straight rebuilds, a couple also include bugfix version updates. ---- rhbz#1490649 - emacs-25.3 is available rhbz#1490410 - unsafe enriched mode translations (security) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-14
    plugin id 103333
    published 2017-09-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103333
    title Fedora 25 : 1:emacs / ImageMagick / WindowMaker / autotrace / converseen / etc (2017-3a568adb31)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-8F27031C8F.NASL
    description Many security fixes, bug fixes, and other changes from the previous version 6.9.3.0. See the [6.9 branch ChangeLog](https://github.com/ImageMagick/ImageMagick/blob/3fd358e2ac3 4977fda38a2cf4d88a1cb4dd2d7c7/ChangeLog). Dependent packages are mostly straight rebuilds, a couple also include bugfix version updates. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-14
    plugin id 103314
    published 2017-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103314
    title Fedora 26 : 1:emacs / ImageMagick / WindowMaker / autotrace / converseen / etc (2017-8f27031c8f)
refmap via4
confirm
gentoo GLSA-201611-21
Last major update 09-05-2017 - 08:40
Published 20-04-2017 - 14:59
Last modified 30-06-2017 - 21:29
Back to Top