usn-3785-1
Vulnerability from osv_ubuntu
Published
2018-10-04 23:13
Modified
2026-04-22 07:36
Summary
imagemagick vulnerabilities
Details
Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick safely, this update includes a default policy change that disables support for the Postscript and PDF formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick policy configuration.
It was discovered that several memory leaks existed when handling certain images in ImageMagick. An attacker could use this to cause a denial of service. (CVE-2018-14434, CVE-2018-14435, CVE-2018-14436, CVE-2018-14437, CVE-2018-16640, CVE-2018-16750)
It was discovered that ImageMagick did not properly initialize a variable before using it when processing MAT images. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14551)
It was discovered that an information disclosure vulnerability existed in ImageMagick when processing XBM images. An attacker could use this to expose sensitive information. (CVE-2018-16323)
It was discovered that an out-of-bounds write vulnerability existed in ImageMagick when handling certain images. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-16642)
It was discovered that ImageMagick did not properly check for errors in some situations. An attacker could use this to cause a denial of service. (CVE-2018-16643)
It was discovered that ImageMagick did not properly validate image meta data in some situations. An attacker could use this to cause a denial of service. (CVE-2018-16644)
It was discovered that ImageMagick did not prevent excessive memory allocation when handling certain image types. An attacker could use this to cause a denial of service. (CVE-2018-16645)
Sergej Schumilo and Cornelius Aschermann discovered that ImageMagick did not properly check for NULL in some situations when processing PNG images. An attacker could use this to cause a denial of service. (CVE-2018-16749)
USN-3681-1 fixed vulnerabilities in Imagemagick. Unfortunately, the fix for CVE-2017-13144 introduced a regression in ImageMagick in Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This update reverts the fix for CVE-2017-13144 for those releases.
We apologize for the inconvenience.
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-14434",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14435",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14436",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14437",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16323",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16640",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16642",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16643",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16644",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16645",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16749",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16750",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "imagemagick",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "imagemagick-common",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "libmagick++5",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "libmagickcore5",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "libmagickcore5-extra",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "libmagickwand5",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
},
{
"binary_name": "perlmagick",
"binary_version": "8:6.7.7.10-6ubuntu3.13"
}
]
},
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "imagemagick",
"purl": "pkg:deb/ubuntu/imagemagick@8:6.7.7.10-6ubuntu3.13?arch=source\u0026distro=trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.7.7.10-6ubuntu3.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8:6.7.7.10-5ubuntu3",
"8:6.7.7.10-5ubuntu4",
"8:6.7.7.10-6ubuntu1",
"8:6.7.7.10-6ubuntu2",
"8:6.7.7.10-6ubuntu3",
"8:6.7.7.10-6ubuntu3.1",
"8:6.7.7.10-6ubuntu3.2",
"8:6.7.7.10-6ubuntu3.3",
"8:6.7.7.10-6ubuntu3.4",
"8:6.7.7.10-6ubuntu3.5",
"8:6.7.7.10-6ubuntu3.6",
"8:6.7.7.10-6ubuntu3.7",
"8:6.7.7.10-6ubuntu3.8",
"8:6.7.7.10-6ubuntu3.9",
"8:6.7.7.10-6ubuntu3.11",
"8:6.7.7.10-6ubuntu3.12"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-14434",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14435",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14436",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14437",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16323",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16640",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16642",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16643",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16644",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16645",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16749",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16750",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "imagemagick",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "imagemagick-6.q16",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "imagemagick-common",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libimage-magick-perl",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libimage-magick-q16-perl",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagick++-6-headers",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagick++-6.q16-5v5",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickcore-6-arch-config",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickcore-6-headers",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickcore-6.q16-2",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickcore-6.q16-2-extra",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickwand-6-headers",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "libmagickwand-6.q16-2",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
},
{
"binary_name": "perlmagick",
"binary_version": "8:6.8.9.9-7ubuntu5.13"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "imagemagick",
"purl": "pkg:deb/ubuntu/imagemagick@8:6.8.9.9-7ubuntu5.13?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.8.9.9-7ubuntu5.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8:6.8.9.9-5ubuntu2",
"8:6.8.9.9-6",
"8:6.8.9.9-6build1",
"8:6.8.9.9-7",
"8:6.8.9.9-7ubuntu1",
"8:6.8.9.9-7ubuntu2",
"8:6.8.9.9-7ubuntu3",
"8:6.8.9.9-7ubuntu4",
"8:6.8.9.9-7ubuntu5",
"8:6.8.9.9-7ubuntu5.1",
"8:6.8.9.9-7ubuntu5.2",
"8:6.8.9.9-7ubuntu5.3",
"8:6.8.9.9-7ubuntu5.4",
"8:6.8.9.9-7ubuntu5.5",
"8:6.8.9.9-7ubuntu5.6",
"8:6.8.9.9-7ubuntu5.7",
"8:6.8.9.9-7ubuntu5.8",
"8:6.8.9.9-7ubuntu5.9",
"8:6.8.9.9-7ubuntu5.11",
"8:6.8.9.9-7ubuntu5.12"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-14434",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14435",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14436",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14437",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-14551",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16323",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16640",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16642",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16643",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16644",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16645",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16749",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-16750",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "negligible",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "imagemagick",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "imagemagick-6-common",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "imagemagick-6.q16",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "imagemagick-6.q16hdri",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "imagemagick-common",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libimage-magick-perl",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libimage-magick-q16-perl",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libimage-magick-q16hdri-perl",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagick++-6-headers",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagick++-6.q16-7",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagick++-6.q16hdri-7",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6-arch-config",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6-headers",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6.q16-3",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6.q16-3-extra",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6.q16hdri-3",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickcore-6.q16hdri-3-extra",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickwand-6-headers",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickwand-6.q16-3",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "libmagickwand-6.q16hdri-3",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
},
{
"binary_name": "perlmagick",
"binary_version": "8:6.9.7.4+dfsg-16ubuntu6.4"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "imagemagick",
"purl": "pkg:deb/ubuntu/imagemagick@8:6.9.7.4+dfsg-16ubuntu6.4?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.9.7.4+dfsg-16ubuntu6.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8:6.9.7.4+dfsg-16ubuntu2",
"8:6.9.7.4+dfsg-16ubuntu3",
"8:6.9.7.4+dfsg-16ubuntu4",
"8:6.9.7.4+dfsg-16ubuntu5",
"8:6.9.7.4+dfsg-16ubuntu6",
"8:6.9.7.4+dfsg-16ubuntu6.2",
"8:6.9.7.4+dfsg-16ubuntu6.3"
]
}
],
"aliases": [],
"details": "Due to a large number of issues discovered in GhostScript that prevent\nit from being used by ImageMagick safely, this update includes a\ndefault policy change that disables support for the Postscript and\nPDF formats in ImageMagick. This policy can be overridden if necessary\nby using an alternate ImageMagick policy configuration.\n\nIt was discovered that several memory leaks existed when handling\ncertain images in ImageMagick. An attacker could use this to cause a\ndenial of service. (CVE-2018-14434, CVE-2018-14435, CVE-2018-14436,\nCVE-2018-14437, CVE-2018-16640, CVE-2018-16750)\n\nIt was discovered that ImageMagick did not properly initialize a\nvariable before using it when processing MAT images. An attacker could\nuse this to cause a denial of service or possibly execute arbitrary\ncode. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14551)\n\nIt was discovered that an information disclosure vulnerability existed\nin ImageMagick when processing XBM images. An attacker could use this\nto expose sensitive information. (CVE-2018-16323)\n\nIt was discovered that an out-of-bounds write vulnerability existed\nin ImageMagick when handling certain images. An attacker could use\nthis to cause a denial of service or possibly execute arbitrary code.\n(CVE-2018-16642)\n\nIt was discovered that ImageMagick did not properly check for errors\nin some situations. An attacker could use this to cause a denial of\nservice. (CVE-2018-16643)\n\nIt was discovered that ImageMagick did not properly validate image\nmeta data in some situations. An attacker could use this to cause a\ndenial of service. (CVE-2018-16644)\n\nIt was discovered that ImageMagick did not prevent excessive memory\nallocation when handling certain image types. An attacker could use\nthis to cause a denial of service. (CVE-2018-16645)\n\nSergej Schumilo and Cornelius Aschermann discovered that ImageMagick\ndid not properly check for NULL in some situations when processing\nPNG images. An attacker could use this to cause a denial of service.\n(CVE-2018-16749)\n\nUSN-3681-1 fixed vulnerabilities in Imagemagick. Unfortunately,\nthe fix for CVE-2017-13144 introduced a regression in ImageMagick in\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. This update reverts the fix\nfor CVE-2017-13144 for those releases.\n\nWe apologize for the inconvenience.\n",
"id": "USN-3785-1",
"modified": "2026-04-22T07:36:36Z",
"published": "2018-10-04T23:13:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-3785-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-14434"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-14435"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-14436"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-14437"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-14551"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16323"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16640"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16642"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16643"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16644"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16645"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16749"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-16750"
},
{
"type": "REPORT",
"url": "https://launchpad.net/bugs/1793485"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "imagemagick vulnerabilities",
"upstream": [
"UBUNTU-CVE-2018-14434",
"UBUNTU-CVE-2018-14435",
"UBUNTU-CVE-2018-14436",
"UBUNTU-CVE-2018-14437",
"UBUNTU-CVE-2018-14551",
"UBUNTU-CVE-2018-16323",
"UBUNTU-CVE-2018-16640",
"UBUNTU-CVE-2018-16642",
"UBUNTU-CVE-2018-16643",
"UBUNTU-CVE-2018-16644",
"UBUNTU-CVE-2018-16645",
"UBUNTU-CVE-2018-16749",
"UBUNTU-CVE-2018-16750"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…