FKIE_CVE-2008-1096

Vulnerability from fkie_nvd - Published: 2008-03-05 20:44 - Updated: 2026-06-16 22:50
Severity
Summary
The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
cve@mitre.orghttp://osvdb.org/43212
cve@mitre.orghttp://secunia.com/advisories/29786
cve@mitre.orghttp://secunia.com/advisories/30967
cve@mitre.orghttp://secunia.com/advisories/32945
cve@mitre.orghttp://secunia.com/advisories/36260
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1858
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2008:099
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-0145.html
cve@mitre.orghttp://www.securityfocus.com/bid/28821
cve@mitre.orghttp://www.securitytracker.com/id?1019880
cve@mitre.orghttp://www.ubuntu.com/usn/USN-681-1
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=286411Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41194
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/43212
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29786
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30967
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32945
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36260
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1858
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2008:099
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-0145.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28821
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019880
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-681-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=286411Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41194
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843
Impacted products
Vendor Product Version
imagemagick graphicsmagick 1.1.7
imagemagick graphicsmagick 1.1.8
imagemagick graphicsmagick 1.1.9
imagemagick graphicsmagick 1.1.10
imagemagick graphicsmagick 1.1.11
imagemagick graphicsmagick 1.1.12
imagemagick imagemagick 6.2.8.0
imagemagick imagemagick 6.2.8.1
imagemagick imagemagick 6.2.8.2
imagemagick imagemagick 6.2.8.3
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAB9E1C7-BCB2-43FF-8CAB-D48EFE723763",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "E32122CF-7871-479D-8C7E-BE5851C31898",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CF70195-5B78-4DA9-9EF4-2E39C03D8DEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D742E790-2ED6-4EBB-8C49-277EB1D73EC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0D10F27-B453-4550-9B63-57D2CEB8F65E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAF8A137-C144-427A-897E-5C3A3C2D5DA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2796AA1-61E5-46E4-B28F-358A49E0B3D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C38A3C0A-0A0A-4433-82BA-AE4D3943E25C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C82A613A-1973-434E-81C5-C2A546C48A4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "72E2AF1B-85A6-4109-83D9-76A44E8DD6E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n load_tile en el codificador XCF de coders/xcf.c en (1) ImageMagick 6.2.8-0 y (2) GraphicsMagick (tambi\u00e9n conocido como gm) 1.1.7 permite a atacantes remotos asistidos por usuarios provocar una denegaci\u00f3n de servicio (ca\u00edda) o prosiblemente ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un archivo .xcf manipulado que dispara una escritura en el mont\u00edculo fuera de rango, posiblemente relacionada con la funci\u00f3n ScaleCharToQuantum."
    }
  ],
  "id": "CVE-2008-1096",
  "lastModified": "2026-06-16T22:50:58.940",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-03-05T20:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/43212"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29786"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/30967"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32945"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36260"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1858"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:099"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0145.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28821"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019880"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-681-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=286411"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41194"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/43212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29786"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/30967"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32945"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36260"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:099"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0145.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019880"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-681-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=286411"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41194"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.