CVE-2012-1185

高 7.8CVE-2012-1185 · 05/06/2012 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
imagemagick imagemagick	`≤ 6.7.5`	修正版なし

概要

Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.

参考情報

lists.opensuse.org/opensuse-updates/2012-06/msg00001.html · Mailing List
secunia.com/advisories/47926 · Broken Link
secunia.com/advisories/48974 · Broken Link
secunia.com/advisories/49043 · Broken Link
secunia.com/advisories/49317 · Broken Link
trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c · Broken Link
trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.c · Broken Link
ubuntu.com/usn/usn-1435-1 · Third Party Advisory
debian.org/security/2012/dsa-2462 · Third Party Advisory
openwall.com/lists/oss-security/2012/03/19/5 · Mailing List
osvdb.org/80556 · Broken Link
securityfocus.com/bid/51957 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/76140 · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン