Lucene search

K
osvGoogleOSV:DSA-1213
HistoryNov 19, 2006 - 12:00 a.m.

imagemagick

2006-11-1900:00:00
Google
osv.dev
7

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.463 Medium

EPSS

Percentile

96.9%

Several remote vulnerabilities have been discovered in Imagemagick,
a collection of image manipulation programs, which may lead to the
execution of arbitrary code. The Common Vulnerabilities and Exposures
project identifies the following problems:

  • CVE-2006-0082
    Daniel Kobras discovered that Imagemagick is vulnerable to format
    string attacks in the filename parsing code.
  • CVE-2006-4144
    Damian Put discovered that Imagemagick is vulnerable to buffer
    overflows in the module for SGI images.
  • CVE-2006-5456
    M Joonas Pihlaja discovered that Imagemagick is vulnerable to buffer
    overflows in the module for DCM and PALM images.
  • CVE-2006-5868
    Daniel Kobras discovered that Imagemagick is vulnerable to buffer
    overflows in the module for SGI images.

This update also addresses regressions in the XCF codec, which were
introduced in the previous security update.

For the stable distribution (sarge) these problems have been fixed in
version 6:6.0.6.2-2.8.

For the upcoming stable distribution (etch) these problems have been
fixed in version 7:6.2.4.5.dfsg1-0.11.

For the unstable distribution (sid) these problems have been fixed in
version 7:6.2.4.5.dfsg1-0.11.

We recommend that you upgrade your imagemagick packages.

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.463 Medium

EPSS

Percentile

96.9%