VulnerabilityModified

CVE-2016-5841

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.

CRITICAL 9.8EPSS 13.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 13.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 13.39% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-190
Affected: imagemagick/imagemagick · oracle/solaris
Source: cve@mitre.org

References

http://www.openwall.com/lists/oss-security/2016/06/23/1Exploit, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/25/3Patch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
http://www.securityfocus.com/bid/91394Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294bVendor Advisory
https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/06/23/1Exploit, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/25/3Patch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
http://www.securityfocus.com/bid/91394Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/d8ab7f046587f2e9f734b687ba7e6e10147c294bVendor Advisory
https://github.com/ImageMagick/ImageMagick/commits/7.0.2-1Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.