CVSS: 6.5EPSS: 2%CPEs: 6EXPL: 0CVE-2018-16644 – ImageMagick: improper check for length in ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c
https://notcve.org/view.php?id=CVE-2018-16644
There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image. Hay una falta de comprobaciones de longitud en las funciones ReadDCMImage de coders/dcm.c y ReadPICTImage de coders/pict.c en ImageMagick 7.0.8-11, lo que permite que los atacantes remotos provoquen una denegación de servicio (DoS) mediante una imagen manipulada. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html https://github.com/ImageMagick/ImageMagick/commit/16916c8979c32765c542e216b31cee2671b7afe7 https://github.com/ImageMagick/ImageMagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135 https://github.com/ImageMagick/ImageMagick/issues/1269 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://usn.ubuntu.com/3785-1 https://usn.ubuntu.com/4034-1 https://www.debian.org/security/2018/dsa-4316 https://access.redhat.com/securi • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-16642 – ImageMagick: out-of-bounds write in InsertRow function in coders/cut.c
https://notcve.org/view.php?id=CVE-2018-16642
The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write. La función InsertRow en coders/cut.c en ImageMagick 7.0.7-37 permite que atacantes remotos provoquen una denegación de servicio (DoS) mediante un archivo de imagen manipulado debido a una escritura fuera de límites. • https://github.com/ImageMagick/ImageMagick/commit/cc4ac341f29fa368da6ef01c207deaf8c61f6a2e https://github.com/ImageMagick/ImageMagick/issues/1162 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://usn.ubuntu.com/3785-1 https://www.debian.org/security/2018/dsa-4316 https://access.redhat.com/security/cve/CVE-2018-16642 https://bugzilla.redhat.com/show_bug.cgi?id=1626591 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-16413
https://notcve.org/view.php?id=CVE-2018-16413
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function. ImageMagick 7.0.8-11 Q16 tiene una sobrelectura de búfer basada en memoria dinámica (heap) en la función PushShortPixel en MagickCore/quantum-private.h cuando se llama desde la función ParseImageResourceBlocks en coders/psd.c. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html http://www.securityfocus.com/bid/105241 https://github.com/ImageMagick/ImageMagick/issues/1249 https://github.com/ImageMagick/ImageMagick/issues/1251 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://usn.ubuntu.com/4034-1 https://www.debian.org/security/2018/dsa-4316 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2018-16412
https://notcve.org/view.php?id=CVE-2018-16412
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function. ImageMagick 7.0.8-11 Q16 tiene una sobrelectura de búfer basada en memoria dinámica (heap) en la función ParseImageResourceBlocks en coders/psd.c. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html http://www.securityfocus.com/bid/105241 https://github.com/ImageMagick/ImageMagick/issues/1250 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://usn.ubuntu.com/4034-1 https://www.debian.org/security/2018/dsa-4316 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16329
https://notcve.org/view.php?id=CVE-2018-16329
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c. En ImageMagick en versiones anteriores a la 7.0.8-8, existe una desreferencia de puntero NULL en la función GetMagickProperty en MagickCore/property.c. • https://github.com/ImageMagick/ImageMagick/issues/1225 • CWE-476: NULL Pointer Dereference •