Skip to content
OpenAdvisories
Unscored CVE-2016-5687 EUVD-2016-6630GHSA-f295-mfq3-hmq6

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecifi…

Published Dec 13, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Package: imagemagick Package: imagemagick Package: imagemagick Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 imagemagick 8:6.9.6.2+dfsg-2 —
Debian 13 imagemagick 8:6.9.6.2+dfsg-2 —
Debian 12 imagemagick 8:6.9.6.2+dfsg-2 —
Debian 8 imagemagick 8:6.8.9.9-5+deb8u4 DSA-3652-1
Debian 7 imagemagick 8:6.7.7.10-5+deb7u8 DLA-731-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS imagemagick 8:6.8.9.9-7ubuntu5.2 USN-3131-1
Ubuntu 14.04 LTS imagemagick 8:6.7.7.10-6ubuntu3.2 USN-3131-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP1 ImageMagick 6.8.8.1-30.2 SUSE-SU-2016:1784-1
SLES 11 SP4 ImageMagick 6.4.3.6-7.45.1 SUSE-SU-2016:2964-1, SUSE-SU-2016:1782-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 ImageMagick 6.8.8.1-30.2 SUSE-SU-2016:1784-1
SLES for SAP 11 SP4 ImageMagick 6.4.3.6-7.45.1 SUSE-SU-2016:2964-1, SUSE-SU-2016:1782-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.4 imagemagick 6.9.5.3 —
Alpine v3.3 imagemagick 6.9.6.8-r0 —
Alpine v3.2 imagemagick 6.9.6.8-r0 —

Advisories 7

References