{"id":"CVE-2016-7448","aliases":["DEBIAN-CVE-2016-7448","DLA-1401-1","DLA-683-1","EUVD-2016-8301","GHSA-rh22-8c8h-hpch","MGASA-2016-0325","SUSE-SU-2016:2724-1","UBUNTU-CVE-2016-7448"],"status":"published","title":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of...","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03846,"percentile":0.90205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2016-09-28T05:59:24Z","modified":"2026-09-22T07:00:34Z","fixes":[{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.3.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","fixed_in":["1.3.18-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","fixed_in":["1.3.23-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-3+deb8u3"}]}],"versions":["1.3.20-3+deb8u1","1.3.20-3+deb8u2"],"bundled":27},{"source":"osv","ecosystem":"Debian:7","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.16-1.1+deb7u5"}]}],"versions":["1.3.16-1.1","1.3.16-1.1+deb7u1","1.3.16-1.1+deb7u2","1.3.16-1.1+deb7u3","1.3.16-1.1+deb7u4"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.25-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.46.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-4.46.1"}]}],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.1"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"graphicsmagick","product":"graphicsmagick"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374233","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-10/msg00094.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/93074","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-10/msg00097.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/18/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7448"},{"url":"https://github.com/advisories/GHSA-rh22-8c8h-hpch"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7448","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0325.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19302","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/09/18/8","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000399","tags":["report"]},{"url":"https://bugzilla.suse.com/1000434","tags":["report"]},{"url":"https://bugzilla.suse.com/1000436","tags":["report"]},{"url":"https://bugzilla.suse.com/1000689","tags":["report"]},{"url":"https://bugzilla.suse.com/1000690","tags":["report"]},{"url":"https://bugzilla.suse.com/1000691","tags":["report"]},{"url":"https://bugzilla.suse.com/1000692","tags":["report"]},{"url":"https://bugzilla.suse.com/1000693","tags":["report"]},{"url":"https://bugzilla.suse.com/1000695","tags":["report"]},{"url":"https://bugzilla.suse.com/1000698","tags":["report"]},{"url":"https://bugzilla.suse.com/1000700","tags":["report"]},{"url":"https://bugzilla.suse.com/1000704","tags":["report"]},{"url":"https://bugzilla.suse.com/1000707","tags":["report"]},{"url":"https://bugzilla.suse.com/1000711","tags":["report"]},{"url":"https://bugzilla.suse.com/1001066","tags":["report"]},{"url":"https://bugzilla.suse.com/1001221","tags":["report"]},{"url":"https://bugzilla.suse.com/1002206","tags":["report"]},{"url":"https://bugzilla.suse.com/1002209","tags":["report"]},{"url":"https://bugzilla.suse.com/1002422","tags":["report"]},{"url":"https://bugzilla.suse.com/1003629","tags":["report"]},{"url":"https://bugzilla.suse.com/1005123","tags":["report"]},{"url":"https://bugzilla.suse.com/1005125","tags":["report"]},{"url":"https://bugzilla.suse.com/1005127","tags":["report"]},{"url":"https://bugzilla.suse.com/999673","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8684","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7448","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7448","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-06T01:57:47.662Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-8301","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:00:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:32.939633Z"}],"ghsa":[{"id":"GHSA-rh22-8c8h-hpch","title":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of...","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2022-05-14T01:10:41Z","modified":"2023-02-02T05:03:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:35.560043Z"}],"nvd":[{"id":"CVE-2016-7448","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:59:00.28Z","modified":"2026-06-17T00:53:05.293Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-7448","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:59:00.28Z","modified":"2026-04-16T06:17:33.338896072Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-7448","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:59:00.28Z","modified":"2026-09-22T07:00:34.209102975Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7448","description":"The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.","status":"published","published":"2017-02-06T17:59:00Z","modified":"2026-04-22T10:57:39.078868Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-1401-1","title":"graphicsmagick - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:07.175701Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-683-1","title":"graphicsmagick - security update","status":"published","published":"2016-10-26T00:00:00Z","modified":"2026-03-09T02:10:18.636656Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0325","title":"Updated graphicsmagick packages fix security vulnerability","description":"A possible heap overflow of the EscapeParenthesis() function\n(CVE-2016-7447).\n\nThe Utah RLE reader did not validate that header information was\nreasonable given the file size and so it could cause huge memory\nallocations and/or consume huge amounts of CPU (CVE-2016-7448).\n\nThe TIFF reader had a bug pertaining to use of TIFFGetField() when a\n'count' value is returned.  The bug caused a heap read overflow (due to\nusing strlcpy() to copy a possibly unterminated string) which could allow\nan untrusted file to crash the software (CVE-2016-7449).\n","status":"published","published":"2016-09-28T05:59:24Z","modified":"2026-04-16T06:23:55.456608537Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2724-1","title":"Security update for GraphicsMagick","description":"\nThis update for GraphicsMagick fixes the following issues:\n\nThese vulnerabilities could be triggered by processing specially crafted image files,\nwhich could lead to a process crash or resource consumtion, or potentially have\nunspecified futher impact.\n\n- CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123)\n- CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127)\n- CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125)\n- CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629)\n- CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422)\n- CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711)\n- CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707)\n- CVE-2016-7531: Pbd file out of bound access (bsc#1000704)\n- CVE-2016-7529: Out-of-bound in quantum handling (bsc#1000399)\n- CVE-2016-7528: Out-of-bound access in xcf file coder (bsc#1000434)\n- CVE-2016-7527: Out-of-bound access in wpg file coder: (bsc#1000436)\n- CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700)\n- CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698)\n- CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695)\n- CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693)\n- CVE-2016-7516: Out-of-bounds problem in rle, pict, viff and sun files (bsc#1000692)\n- CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689)\n- CVE-2016-7446 CVE-2016-7447 CVE-2016-7448 CVE-2016-7449: various issues fixed in 1.3.25 (bsc#999673)\n- CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221)\n- CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066)\n- CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691)\n- CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690)\n- Divide by zero in WriteTIFFImage (bsc#1002206)\n- Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209)\n","status":"published","published":"2016-11-04T10:18:42Z","modified":"2026-02-04T03:28:22.415799Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}