Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its BMP image processing component allows a remote attacker to crash the application by providing a specially crafted image file. This could lead to a denial of service, impacting the availability of web services or automated systems that process user-uploaded images.
Technical details
An integer overflow vulnerability exists in the BMP coder component of ImageMagick when converting images to the BMP format. The root cause is an arithmetic overflow during the calculation of image size, where the product of the height and width parameters is not properly validated. An attacker can exploit this by providing a crafted image (e.g., a PPM file) with specific dimensions, leading to an out-of-bounds write and a subsequent application crash. The vulnerability is reachable remotely if the application processes untrusted image files. A fix was introduced in version 7.0.2-10 and backported to relevant 6.x branches.
Affected products
- ImageMagick ImageMagick < 7.0.2-10, < 6.9.10-50
Timeline
- 2016-08-15: patched: Fix committed to ImageMagick repository
- 2016-09-26: disclosed: Public disclosure on oss-security mailing list
- 2017-01-18: advisory: NVD advisory published