CVE-2016-7448
HighSummary
The Utah RLE reader in GraphicsMagick before version 1.3.25 allows remote attackers to cause a denial of service via vectors involving the header information and the file size.
Risk Assessment
Attackers can lead to high CPU consumption or large memory allocations, potentially affecting service availability in the organization.
Recommendation
It is recommended to update GraphicsMagick to version 1.3.25 or later to mitigate this vulnerability.
Other vulnerabilities in GraphicsMagick
See all- CVE-2017-17912High
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.
- CVE-2017-17783High
In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.
- CVE-2017-17782High
In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.
- CVE-2017-17503High
GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17502High
GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17501High
GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.
- CVE-2017-17500High
GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.
- CVE-2017-17498High
The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.
- CVE-2017-16669High
GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.
- CVE-2017-16547High
The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.
Original NVD description (English source)
The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.