ImageMagick < 6.9.13-40 / 7.x < 7.1.2-15 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(322795);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id("CVE-2026-56371", "CVE-2026-56379");
  script_xref(name:"IAVB", value:"2026-B-0177");

  script_name(english:"ImageMagick < 6.9.13-40 / 7.x < 7.1.2-15 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of ImageMagick installed that is prior to 6.9.13-40 or 7.x prior to 7.1.2-15. It is,
therefore, affected by multiple vulnerabilities:

  - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT
    files with texture attributes: the texture object allocated via ReadImage is not released when
    GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is
    processed. (CVE-2026-56371)

  - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG
    decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious
    SVG files with injected Magick Vector Graphics commands that execute during rendering.
    (CVE-2026-56379)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ee558204");
  # https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3e9c216");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ImageMagick version 6.9.13-40 / 7.1.2-15 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56379");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:imagemagick:imagemagick");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("imagemagick_installed.nasl", "imagemagick_macos_installed.nbin", "imagemagick_nix_installed.nbin");
  script_require_keys("installed_sw/ImageMagick");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'check_algorithm': 'default',
      'product': {'name': 'ImageMagick', 'type': 'app'},
      'constraints': [
        { 'fixed_version' : '6.9.13.40', 'fixed_display' : '6.9.13-40' },
        { 'min_version' : '7.0.0', 'fixed_version' : '7.1.2.15', 'fixed_display' : '7.1.2-15' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);