crítica
CVE-2016-5841
ImageMagick: Integer overflow in MagickCore/profile.c
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Amazon (alta), Ubuntu (media).
Descripción
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | imagemagick | 6.9.6.8-r0 |
| alpine 3.3 | imagemagick | 6.9.6.8-r0 |
| alpine 3.4 | imagemagick | 6.9.5.3 |
| amazon linux 1 | ImageMagick, ImageMagick-c++, ImageMagick-c++-devel y 4 más | 6.9.10.68-3.22.amzn1 |
| amazon linux 2 | ImageMagick, ImageMagick-c++, ImageMagick-c++-devel y 4 más | 6.9.10.68-3.amzn2.0.1 |
| chainguard | imagemagick-6 | 0 |
| debian 11 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 12 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 13 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 14 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 7 | imagemagick | 8:6.7.7.10-5+deb7u8 |
| debian 8 | imagemagick | 8:6.8.9.9-5+deb8u4 |
Mostrar las 34 entradas de 22 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.2 | imagemagick | 6.9.6.8-r0 |
| alpine 3.3 | imagemagick | 6.9.6.8-r0 |
| alpine 3.4 | imagemagick | 6.9.5.3 |
| amazon linux 1 | ImageMagick | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-c++ | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-c++-devel | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-debuginfo | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-devel | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-doc | 6.9.10.68-3.22.amzn1 |
| amazon linux 1 | ImageMagick-perl | 6.9.10.68-3.22.amzn1 |
| amazon linux 2 | ImageMagick | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-c++ | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-c++-devel | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-debuginfo | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-devel | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-doc | 6.9.10.68-3.amzn2.0.1 |
| amazon linux 2 | ImageMagick-perl | 6.9.10.68-3.amzn2.0.1 |
| chainguard | imagemagick-6 | 0 |
| debian 11 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 12 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 13 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 14 | imagemagick | 8:6.9.6.2+dfsg-2 |
| debian 7 | imagemagick | 8:6.7.7.10-5+deb7u8 |
| debian 8 | imagemagick | 8:6.8.9.9-5+deb8u4 |
| echo | imagemagick | 8:6.9.6.2+dfsg-2 |
| root.io debian 11 | rootio-imagemagick | 8:6.9.6.2+dfsg-2 |
| root.io debian 12 | rootio-imagemagick | 8:6.9.6.2+dfsg-2 |
| root.io debian 13 | rootio-imagemagick | 8:6.9.6.2+dfsg-2 |
| ubuntu 12.04 | imagemagick | 8:6.6.9.7-5ubuntu3.5 |
| ubuntu 14.04 | imagemagick | 8:6.7.7.10-6ubuntu3.2 |
| ubuntu 14.04-ESM | imagemagick | 8:6.7.7.10-6ubuntu3.2 |
| ubuntu 16.04 | imagemagick | 8:6.8.9.9-7ubuntu5.2 |
| ubuntu 16.04-ESM | imagemagick | 8:6.8.9.9-7ubuntu5.2 |
| ubuntu 16.10 | imagemagick | 8:6.8.9.9-7ubuntu8.1 |
Referencias
- http://www.openwall.com/lists/oss-security/2016/06/23/1
- http://www.openwall.com/lists/oss-security/2016/06/25/3
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/91394
- https://access.redhat.com/security/cve/CVE-2016-5841
- https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294b
- https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1
- https://nvd.nist.gov/vuln/detail/CVE-2016-5841