CVE-2012-1185

HIGH 7.8CVE-2012-1185 · Published 05/06/2012 · updated 16/06/2026

Package	Affected versions	Patched versions
imagemagick imagemagick	`≤ 6.7.5`	No fix yet

Description

Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.

References

lists.opensuse.org/opensuse-updates/2012-06/msg00001.html · Mailing List
secunia.com/advisories/47926 · Broken Link
secunia.com/advisories/48974 · Broken Link
secunia.com/advisories/49043 · Broken Link
secunia.com/advisories/49317 · Broken Link
trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c · Broken Link
trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.c · Broken Link
ubuntu.com/usn/usn-1435-1 · Third Party Advisory
debian.org/security/2012/dsa-2462 · Third Party Advisory
openwall.com/lists/oss-security/2012/03/19/5 · Mailing List
osvdb.org/80556 · Broken Link
securityfocus.com/bid/51957 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/76140 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free