| Package | Affected versions | Patched versions |
|---|---|---|
| Magick.NET-Q16-AnyCPU | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-AnyCPU | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-OpenMP-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-HDRI-x86 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-OpenMP-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-OpenMP-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q16-x86 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-AnyCPU | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-OpenMP-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-OpenMP-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-arm64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-x64 | < 13.2.0 | 13.2.0 |
| Magick.NET-Q8-x86 | < 13.2.0 | 13.2.0 |
| imagemagick | < 7.1.1-14 | 7.1.1-14 |
While Processing a crafted TIFF file, imagemagick crashes.
Following is the imagemagick version:
imagemagick_git/build_26jun23/bin/magick --version
Version: ImageMagick 7.1.1-13 (Beta) Q16-HDRI x86_64 56f478940:20230625 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI
Delegates (built-in): fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff webp x xml zlib
Compiler: gcc (4.2)
issue can be replicated with following command with provided POC file(sent over email):
magick poc.tiff /dev/null
This can lead to application crash.
Please give credits to Hardik shah of Vehere (Dawn Treaders team)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free