4.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.1%
ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a module
policy in policy.xml
. ex. <policy domain=“module” rights=“none” pattern=“PS” />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the module
policy and instead use the coder
policy that is also our workaround recommendation: <policy domain=“coder” rights=“none” pattern=“{PS,EPI,EPS,EPSF,EPSI}” />.
[
{
"vendor": "ImageMagick",
"product": "ImageMagick",
"versions": [
{
"version": ">= 7.0.0, < 7.1.0-7",
"status": "affected"
},
{
"version": "< 6.9.12-22",
"status": "affected"
}
]
}
]
4.4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.1%