ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage.
The product reads data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
https://usn.ubuntu.com/3681-1/ | third party advisory vendor advisory |
https://www.debian.org/security/2017/dsa-4074 | third party advisory vendor advisory |
https://github.com/ImageMagick/ImageMagick/issues/872 | exploit third party advisory patch |
https://lists.debian.org/debian-lts-announce/2018/01/msg00000.html | third party advisory mailing list |
https://www.debian.org/security/2018/dsa-4204 | third party advisory vendor advisory |