CVE-2016-6491

Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.

Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.

The imagemagick package has been updated to version 6.9.9.41 which fixes several unspecified security vulnerabilities. This update fixes several vulnerabilities in imagemagick, including: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files are processed.

Several packages have been rebuilt for the updated ImageMagick.

This update for ImageMagick fixes the following issues:

• security update:
  • CVE-2016-6520: buffer overflow [bsc#991872]
  • CVE-2016-6491: Out-of-bounds read in CopyMagickMemory [bsc#991445]

This update for ImageMagick fixes the following issues:

• security update:
  • CVE-2016-6520: buffer overflow [bsc#991872]
  • CVE-2016-5010: Out-of-bounds read in CopyMagickMemory [bsc#991444]
  • CVE-2016-6491: Out-of-bounds read when processing crafted tiff files [bsc#991445]

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.