Junglewise Threat Intelligence

CVE-2016-7799: ImageMagick out-of-bounds read in MagickCore/profile.c

CVE-2016-7799 · Severity: medium · CVSS 6.5 · Published 2017-01-18

Technologies: ImageMagick. Vendors: ImageMagick.

Executive brief

ImageMagick is a widely used software suite for editing and converting digital images. A vulnerability in how it handles image metadata (EXIF profiles) allows an attacker to crash applications using the library by providing a specially crafted image file. This can lead to a denial of service, potentially disrupting automated image processing workflows or web services that allow user-uploaded content.

Technical details

An out-of-bounds read vulnerability exists in MagickCore/profile.c within ImageMagick's SyncExifProfile function. The root cause is an insufficient validation of the 'format' field read from an EXIF profile; specifically, the code failed to check for negative values before using the variable to index the 'format_bytes' global array. A remote attacker can exploit this by providing a maliciously crafted image file that, when processed by tools like 'identify' or 'mogrify', triggers a global buffer overflow (read). This results in an application crash (denial of service). The issue was addressed in versions 7.0.3-2 and 6.9.6-0 by adding a bounds check for the format variable.

Affected products

  • ImageMagick ImageMagick < 7.0.3-2, < 6.9.6-0

Timeline

  • 2016-09-30: disclosed: Issue reported on GitHub by Marco Grassi
  • 2016-10-01: patched: Fix committed to ImageMagick repository
  • 2017-01-18: advisory: NVD publication date

References