CERTA-2006-AVI-361
Vulnerability from certfr_avis

None

Description

Une vulnérabilité de type débordement de mémoire a été découverte dans l'application ImageMagick. Elle permet à un utilisateur mal intentionné de provoquer un déni de service au moyen d'une image au format SGI spécialement construite. Cette vulnérabilité pourrait également permettre l'exécution de code arbitraire sur le système vulnérable.

Solution

Appliquer la mise à jour de sécurité en passant à la version 6.2.9 de ImageMagick disponible à l'adresse suivante :

http://www.imagemagick.org/script/download.php

ImageMagick 6.2.8 et versions antérieures.

Impacted products
Vendor Product Description
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eImageMagick 6.2.8 et versions ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire a \u00e9t\u00e9 d\u00e9couverte dans\nl\u0027application ImageMagick. Elle permet \u00e0 un utilisateur mal intentionn\u00e9\nde provoquer un d\u00e9ni de service au moyen d\u0027une image au format SGI\nsp\u00e9cialement construite. Cette vuln\u00e9rabilit\u00e9 pourrait \u00e9galement\npermettre l\u0027ex\u00e9cution de code arbitraire sur le syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nAppliquer la mise \u00e0 jour de s\u00e9curit\u00e9 en passant \u00e0 la version 6.2.9 de\nImageMagick disponible \u00e0 l\u0027adresse suivante :\n\n    http://www.imagemagick.org/script/download.php\n",
  "cves": [
    {
      "name": "CVE-2006-3744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3744"
    },
    {
      "name": "CVE-2006-3743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3743"
    }
  ],
  "initial_release_date": "2006-08-17T00:00:00",
  "last_revision_date": "2006-09-28T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE SUSA-SA:2006:050 du 08 septembre    2006 :",
      "url": "http://www.novell.com/linux/security/advisories/2006_50_imagemagick.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1168 du 04 septembre 2006 :",
      "url": "http://www.debian.org/security/2006/dsa-1168"
    },
    {
      "title": "Site Internet de l\u0027\u00e9diteur :",
      "url": "http://www.imagemagick.org"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0633 du 24 ao\u00fbt 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0633.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:155 du 29 ao\u00fbt    2006 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:155"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200609-14 du 26 septembre    2006 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200609-14.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-340-1 du 06 septembre 2006    :",
      "url": "http://www.ubuntu.com/usn/usn-340-1"
    }
  ],
  "reference": "CERTA-2006-AVI-361",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-08-17T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences CVE et des bulletins de s\u00e9curit\u00e9 de RedHat, Mandriva, Debian, Ubuntu, SuSE.",
      "revision_date": "2006-09-11T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 de Gentoo.",
      "revision_date": "2006-09-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans ImageMagick",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 ImageMagick",
      "url": "http://www.imagemagick.org/script/download.php"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.