NVD Vulnerability Detail

CVE-2016-5688

Summary	The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
Publication Date	Dec. 14, 2016, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:14 p.m.
Last Update	Nov. 21, 2024, 11:54 a.m.

CVSS3.0 : HIGH
スコア	8.1
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : MEDIUM
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick:7.0.1-4:::::::*
cpe:2.3:a:imagemagick:imagemagick:7.0.1-1:::::::*
cpe:2.3:a:imagemagick:imagemagick::::::::		6.9.4-3
cpe:2.3:a:imagemagick:imagemagick:7.0.1-3:::::::*
cpe:2.3:a:imagemagick:imagemagick:7.0.1-2:::::::*
cpe:2.3:a:imagemagick:imagemagick:7.0.1-0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2016/06/14/5	Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2016/06/14/5	Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2016/06/17/3	Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2016/06/17/3	Third Party Advisory
5	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
6	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
7	http://www.securityfocus.com/bid/91283	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/91283	Third Party Advisory VDB Entry
9	https://blog.fuzzing-project.org/46-Various-invalid-memory-reads-in-ImageMagick-WPG%2C-DDS%2C-DCM.html
10	https://blog.fuzzing-project.org/46-Various-invalid-memory-reads-in-ImageMagick-WPG%2C-DDS%2C-DCM.html
11	https://github.com/ImageMagick/ImageMagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f	Patch Vendor Advisory
12	https://github.com/ImageMagick/ImageMagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f	Patch Vendor Advisory
13	https://github.com/ImageMagick/ImageMagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7	Patch Vendor Advisory
14	https://github.com/ImageMagick/ImageMagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7	Patch Vendor Advisory
15	https://github.com/ImageMagick/ImageMagick/commits/6.9.4-4	Patch Vendor Advisory
16	https://github.com/ImageMagick/ImageMagick/commits/6.9.4-4	Patch Vendor Advisory
17	https://github.com/ImageMagick/ImageMagick/commits/7.0.1-5	Patch Vendor Advisory
18	https://github.com/ImageMagick/ImageMagick/commits/7.0.1-5	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

ImageMagick の WPG パーサにおける脆弱性

Title	ImageMagick の WPG パーサにおける脆弱性
Summary	ImageMagick の WPG パーサには、メモリ制限が設定されている場合、不特定の影響を受ける脆弱性が存在します。
Possible impacts	リモートの攻撃者により、SetImageExtent の戻り値のチェックに関する処理を介して、以下を誘発されることで、不特定の影響を受ける可能性があります。 (1) SetPixelIndex 関数のヒープベースのバッファオーバーフロー (2) ScaleCharToQuantum 関数の無効な書き込み操作 (3) SetPixelIndex 関数の無効な書き込み操作
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 18, 2016, midnight
Registration Date	Dec. 26, 2016, 4:55 p.m.
Last Update	Dec. 26, 2016, 4:55 p.m.

Affected System

オラクル

Oracle Solaris 11.3

ImageMagick

ImageMagick 6.9.4-4 未満

ImageMagick 7.0.1-5 未満の 7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-5688	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5688
National Vulnerability Database (NVD)
2	CVE-2016-5688	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5688

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
GitHub
1	6.9.4-4	https://github.com/ImageMagick/ImageMagick/commits/6.9.4-4
2	7.0.1-5	https://github.com/ImageMagick/ImageMagick/commits/7.0.1-5
3	Set pixel cache to undefined if any resource limit is exceeded	https://github.com/ImageMagick/ImageMagick/commit/aecd0ada163a4d6c769cec178955d5f3e9316f2f
4	Set pixel cache to undefined if any resource limit is exceeded	https://github.com/ImageMagick/ImageMagick/commit/fc43974d34318c834fbf78570ca1a3764ed8c7d7
Oracle Technology Network
5	Oracle Solaris Third Party Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Change Log

No	Changed Details	Date of change
0	[2016年12月26日] 掲載	Feb. 17, 2018, 10:37 a.m.