CVE-2009-1882

CRITICAL 9.3CVE-2009-1882 · Published 02/06/2009 · updated 16/06/2026

In short

CVE-2009-1882 is a CRITICAL (CVSS 9.3) vulnerability affecting imagemagick (imagemagick).
Chance of exploitation in the next 30 days (EPSS): 7.2%, higher than 94.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
imagemagick imagemagick	`= 6.5.2-8`	No fix yet

Description

Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow. NOTE: some of these details are obtained from third party information.

References

imagemagick.org/script/changelog.php
lists.fedoraproject.org/pipermail/package-announce/2010-January/033766.html
lists.fedoraproject.org/pipermail/package-announce/2010-January/033833.html
lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
mirror1.smudge-it.co.uk/imagemagick/www/changelog.html
osvdb.org/54729
secunia.com/advisories/35216 · Vendor Advisory
secunia.com/advisories/35382
secunia.com/advisories/35685
secunia.com/advisories/36260
secunia.com/advisories/37959
secunia.com/advisories/55721
security.gentoo.org/glsa/glsa-201311-10.xml
wiki.rpath.com/Advisories:rPSA-2010-0074

More vulnerabilities in imagemagick

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free