fkie_cve-2007-4987
Vulnerability from fkie_nvd
Published
2007-09-24 22:17
Modified
2025-04-09 00:30
Severity ?
Summary
Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0D83FADC-4C7F-4C16-BBAA-9883D7449744",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "04A019EA-DB16-41D5-A625-CBD96F24416E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D2563ABE-D1C3-4AB8-BC41-8029E358C2CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B45B5EE8-00FB-46FE-9A26-7468AD30B540",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6534A963-C0A7-47D6-8E1B-B8D0F3933428",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1FD06A99-7CBF-4593-9EA1-5D1A800D8C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8BDC9494-E79B-4497-8413-A44DF326ABB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.4.8.2_1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "22890DA5-6F77-4CA5-8DE4-0C66C3A3D370",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.3_.2_1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E16A926-05F2-495E-B17B-D23624F55A2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2D1F61BB-FF5B-4196-8723-AA165B077E36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B02E4063-E2B2-4EC5-9864-D2FB3E73F574",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.6.0_20030409:*:*:*:*:*:*:*",
"matchCriteriaId": "B3FA6C29-443C-4A33-AA14-56ADA6D052F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "193A610A-5E5E-4A87-A501-902100D1C2AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:5.5.7.15:*:*:*:*:*:*:*",
"matchCriteriaId": "B9C7FD38-93D3-456B-ABD5-9A2A8A0716E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A27CAC75-BFE8-4865-A6AE-20225BFCDBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6393827E-8F17-4C95-B1E2-D6049B8AA63F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "46F682CD-0117-4770-877F-1F3903BAFE04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5717E4CF-15CD-4369-801F-7E113F0FAFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A34B9CBD-54BC-4131-820F-9483E50086BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7AD7EB24-20F1-493F-BD38-DF39638C319B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2A6E66D8-BEC4-4E0D-BAAE-979618405C21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5E62DFAA-1EFC-40D6-A4B5-9113DF0656B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D8BD0D69-A809-4DD3-824B-C68E3EF4F724",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F91C63C5-765B-4511-B6CF-CA09433DE051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "ABC271B0-ACAC-478E-B00B-FFBAAE33B5E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DF9BACC6-DEF1-4C20-B627-3AA55471B372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8CA96D5B-FD43-418E-980C-22DEBA4FC03D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "83A3469D-AE33-4933-A4F2-3DEFF3F223F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A55053EA-780E-46A9-91AE-F983DD54D154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8168249B-863D-44E3-8BC3-B877A64981B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A688471B-3A88-410B-AAD3-20A75E1A767E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "02F76B8D-D105-4106-B52C-FC201F5930AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8EB7AE5B-83D9-4DF5-A9A0-B0412D8C0B1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "600590DA-A2F4-488F-B85B-9B3B86A8FC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "096FC2CB-49A7-444A-BDA6-802E123A9ED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BB2E37B-323A-4336-B081-56BD32260E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "311D7BB5-0740-4122-8465-B03B5C40351A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "03ADE3A3-8FA5-439A-97ED-6EE93ED43699",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "11A48433-240E-4555-966B-4BA767AA3C6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0900904-462F-47DF-82C8-DD69D3E1EC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CB80DF3F-DE3F-4CB3-B021-26B8D9F3B550",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F2BF18B6-A20E-44D1-A9D1-0F7762E0C506",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CDA9ACBD-6065-4340-B987-560BE5A54FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2AEEF22D-83DE-41FA-941C-C02C45D7B5DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "74068962-7689-4155-91D7-506CD30BAFB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8BD4D7D7-C230-4986-9CA8-C4C7F9B9DC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "EDE3052B-3341-4B5C-A21F-4A10984D2641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "8A57BE9F-C790-4BEF-9A91-E6C565A1C1D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "572F13C8-4FCC-4BF2-BECA-D957AC62DD51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "AB9DC98B-77B4-4CB3-BEAA-71ECC9805BAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5D0F3B37-EE8D-46F3-861C-4D90E2699AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5410220-889F-4D5F-9C23-3442272F4327",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9A317A0F-D871-49B8-8D0D-EE96DF7B6622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.3_3:*:*:*:*:*:*:*",
"matchCriteriaId": "93E858A4-1BB5-4CEF-B2D4-EEA3DE3D8218",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.3_5:*:*:*:*:*:*:*",
"matchCriteriaId": "D09D188F-0193-435C-BBAF-B3977B6997F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.3_6:*:*:*:*:*:*:*",
"matchCriteriaId": "9EB9051F-CFA7-4ACC-AB6F-0FBB10A8A076",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:6.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "195D7B1C-7550-480A-B2B8-7D868B654674",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a \u0027\\0\u0027 character to an out-of-bounds address."
},
{
"lang": "es",
"value": "Error de superaci\u00f3n de l\u00edmite (off-by-one) en la funci\u00f3n ReadBlobString en blob.c de ImageMagick versiones anteriores a 6.3.5-9 permite a atacantes locales o remotos dependientes del contexto ejecutar c\u00f3digo de su elecci\u00f3n mediante un fichero de imagen manipulado, que dispara la escritura de un caracter \u0027\\0\u0027 en una direcci\u00f3n fuera de l\u00edmites.\r\n"
}
],
"id": "CVE-2007-4987",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-09-24T22:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=186030"
},
{
"source": "cve@mitre.org",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=595"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/26926"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27048"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27309"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27364"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27439"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/28721"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/36260"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200710-27.xml"
},
{
"source": "cve@mitre.org",
"url": "http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2009/dsa-1858"
},
{
"source": "cve@mitre.org",
"url": "http://www.imagemagick.org/script/changelog.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2007_23_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/483572/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/25766"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1018729"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/usn-523-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3245"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36739"
},
{
"source": "cve@mitre.org",
"url": "https://issues.rpath.com/browse/RPL-1743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=186030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=595"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/26926"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27048"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27309"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27364"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/28721"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/36260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200710-27.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2009/dsa-1858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.imagemagick.org/script/changelog.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2007_23_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/483572/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/25766"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1018729"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/usn-523-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36739"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://issues.rpath.com/browse/RPL-1743"
}
],
"sourceIdentifier": "cve@mitre.org",
"vendorComments": [
{
"comment": "Note: As the address of the overwritten byte is not under attacker\u2019s control, the worst impact his bug could have is an application crash. It can not be exploited to execute arbitrary code.",
"lastModified": "2007-12-05T00:00:00",
"organization": "Red Hat"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-189"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…