CVE-2018-18024 - In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bm

CVE-2018-18024

Summary

In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

References

https://github.com/ImageMagick/ImageMagick/issues/1337
https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
https://usn.ubuntu.com/4034-1/

Vulnerable Configurations

cpe:2.3:a:imagemagick:imagemagick:7.0.8-13:q16:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:7.0.8-13:q16:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 19-08-2020 - 02:15)
Impact:
Exploitability:

CWE

CWE-835

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

misc	https://github.com/ImageMagick/ImageMagick/issues/1337
mlist	[debian-lts-announce] 20200818 [SECURITY] [DLA 2333-1] imagemagick security update
ubuntu	USN-4034-1

Last major update

19-08-2020 - 02:15

Published

07-10-2018 - 18:29

Last modified

19-08-2020 - 02:15