CVE-2018-15607

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Mitigation

Administrators can mitigate this issue by setting reasonable limits on size of processed image, consumed memory, time limit, etc. For example, disallowing the processing of large images (e.g. having either width or height larger than 10240 pixels) which consumes a lot of CPU time can be done by adding the following XML child elements under <policymap> element in /etc/ImageMagick/policy.xml:

<policy domain="resource" name="width" value="10KP"/>  
<policy domain="resource" name="height" value="10KP"/>