When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the GetPixelIndex() function, called from the WritePICONImage function in coders/xpm.c.
The product reads data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
https://github.com/ImageMagick/ImageMagick/issues/581 | issue tracking patch exploit third party advisory |
http://www.securityfocus.com/bid/99929 | vdb entry third party advisory |