Vulnerability Description
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | <= 7.0.2-0 |
| Oracle | Solaris | 10.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/06/23/1ExploitPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/25/3PatchThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/91394Third Party AdvisoryVDB Entry
- https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6eVendor Advisory
- https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1PatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/06/23/1ExploitPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/25/3PatchThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/91394Third Party AdvisoryVDB Entry
- https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6eVendor Advisory
- https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1PatchVendor Advisory
FAQ
What is CVE-2016-5841?
CVE-2016-5841 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involvin...
How severe is CVE-2016-5841?
CVE-2016-5841 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-5841?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick, Oracle Solaris.