CERTA-2006-AVI-361

Vulnerability from certfr_avis - Published: - Updated:

None

Description

Une vulnérabilité de type débordement de mémoire a été découverte dans l'application ImageMagick. Elle permet à un utilisateur mal intentionné de provoquer un déni de service au moyen d'une image au format SGI spécialement construite. Cette vulnérabilité pourrait également permettre l'exécution de code arbitraire sur le système vulnérable.

Solution

Appliquer la mise à jour de sécurité en passant à la version 6.2.9 de ImageMagick disponible à l'adresse suivante :

http://www.imagemagick.org/script/download.php

ImageMagick 6.2.8 et versions antérieures.

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eImageMagick 6.2.8 et versions ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire a \u00e9t\u00e9 d\u00e9couverte dans\nl\u0027application ImageMagick. Elle permet \u00e0 un utilisateur mal intentionn\u00e9\nde provoquer un d\u00e9ni de service au moyen d\u0027une image au format SGI\nsp\u00e9cialement construite. Cette vuln\u00e9rabilit\u00e9 pourrait \u00e9galement\npermettre l\u0027ex\u00e9cution de code arbitraire sur le syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nAppliquer la mise \u00e0 jour de s\u00e9curit\u00e9 en passant \u00e0 la version 6.2.9 de\nImageMagick disponible \u00e0 l\u0027adresse suivante :\n\n    http://www.imagemagick.org/script/download.php\n",
  "cves": [
    {
      "name": "CVE-2006-3744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3744"
    },
    {
      "name": "CVE-2006-3743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3743"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SuSE SUSA-SA:2006:050 du 08 septembre    2006 :",
      "url": "http://www.novell.com/linux/security/advisories/2006_50_imagemagick.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1168 du 04 septembre 2006 :",
      "url": "http://www.debian.org/security/2006/dsa-1168"
    },
    {
      "title": "Site Internet de l\u0027\u00e9diteur :",
      "url": "http://www.imagemagick.org"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0633 du 24 ao\u00fbt 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0633.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:155 du 29 ao\u00fbt    2006 :",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:155"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200609-14 du 26 septembre    2006 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200609-14.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-340-1 du 06 septembre 2006    :",
      "url": "http://www.ubuntu.com/usn/usn-340-1"
    }
  ],
  "reference": "CERTA-2006-AVI-361",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-08-17T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences CVE et des bulletins de s\u00e9curit\u00e9 de RedHat, Mandriva, Debian, Ubuntu, SuSE.",
      "revision_date": "2006-09-11T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 de Gentoo.",
      "revision_date": "2006-09-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans ImageMagick",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 ImageMagick",
      "url": "http://www.imagemagick.org/script/download.php"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.