CVE-2016-4564

Critical

Published: 04/06/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The DrawImage function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 contains an incorrect function call, which may lead to buffer overflow and application crash. Remote attackers can exploit this vulnerability by sending a crafted file.

Risk Assessment

This vulnerability can lead to denial of service, affecting application availability. There is also a risk of unspecified other impact on the system.

Recommendation

It is recommended to update ImageMagick to version 6.9.4-0 or 7.0.1-2 or later to mitigate this vulnerability.

Original NVD description (English source)

The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.