CVE-2018-16641 — Missing Release of Resource after Effective Lifetime in Imagemagick

CWE-772 — Missing Release of Resource after Effective LifetimeCWE-125 — Out-of-bounds Read6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 38.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ImagemagickDebian Imagemagick
Timeline
PublishedSep 6
Latest updateMay 13

Description

ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-g7p2-3xmf-r7r6: ImageMagick 7↗2022-05-13
▶

📋Vendor Advisories

2
Red Hat
ImageMagick: memory leak in TIFFWritePhotoshopLayers function in coders/tiff.c↗2018-07-12
▶
Debian
CVE-2018-16641: imagemagick - ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLay...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-16641 ImageMagick: memory leak in TIFFWritePhotoshopLayers function in coders/tiff.c [fedora-all]↗2018-09-07
▶
Bugzilla
CVE-2018-16641 ImageMagick: memory leak in TIFFWritePhotoshopLayers function in coders/tiff.c↗2018-09-07
▶