National Cyber Awareness System

Vulnerability Summary for CVE-2007-4985

Overview

ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 25764

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/25764

External Source: VUPEN

Name: ADV-2007-3245

Hyperlink:http://www.vupen.com/english/advisories/2007/3245

External Source: DEBIAN

Name: DSA-1858

Hyperlink:http://www.debian.org/security/2009/dsa-1858

External Source: MLIST

Name: [Magick-announce] 20070917 ImageMagick 6.3.5-9, important security updates

Hyperlink:http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html

External Source: SECUNIA

Name: 36260

Hyperlink:http://secunia.com/advisories/36260

External Source: OVAL

Name: oval:org.mitre.oval:def:10869

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10869

External Source: IDEFENSE

Name: 20070919 Multiple Vendor ImageMagick Multiple Denial of Service Vulnerabilities

Hyperlink:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=596

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1743

Hyperlink:https://issues.rpath.com/browse/RPL-1743

External Source: XF

Name: imagemagick-readdcmimage-readxcfimage-dos(36740)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36740

External Source: UBUNTU

Name: USN-523-1

Hyperlink:http://www.ubuntu.com/usn/usn-523-1

External Source: SECTRACK

Name: 1018729

Hyperlink:http://www.securitytracker.com/id?1018729

External Source: BUGTRAQ

Name: 20071112 FLEA-2007-0066-1 ImageMagick

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/483572/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0165

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0165.html

External Source: REDHAT

Name: RHSA-2008:0145

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0145.html

External Source: SUSE

Name: SUSE-SR:2007:023

Hyperlink:http://www.novell.com/linux/security/advisories/2007_23_sr.html

External Source: MANDRIVA

Name: MDVSA-2008:035

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035

External Source: CONFIRM

Name: http://www.imagemagick.org/script/changelog.php

Hyperlink:http://www.imagemagick.org/script/changelog.php

External Source: GENTOO

Name: GLSA-200710-27

Hyperlink:http://security.gentoo.org/glsa/glsa-200710-27.xml

External Source: SECUNIA

Name: 29857

Hyperlink:http://secunia.com/advisories/29857

External Source: SECUNIA

Name: 29786

Hyperlink:http://secunia.com/advisories/29786

External Source: SECUNIA

Name: 28721

Hyperlink:http://secunia.com/advisories/28721

External Source: SECUNIA

Name: 27439

Hyperlink:http://secunia.com/advisories/27439

External Source: SECUNIA

Name: 27364

Hyperlink:http://secunia.com/advisories/27364

External Source: SECUNIA

Name: 27309

Hyperlink:http://secunia.com/advisories/27309

External Source: SECUNIA

Name: 27048

Hyperlink:http://secunia.com/advisories/27048

External Source: SECUNIA

Name: 26926

Hyperlink:http://secunia.com/advisories/26926

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=186030

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=186030

References to Check Content

Identifier:oval:org.mitre.oval:def:10869

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10869