National Cyber Awareness System

Vulnerability Summary for CVE-2007-4986

Overview

Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 25763

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/25763

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1743

Hyperlink:https://issues.rpath.com/browse/RPL-1743

External Source: XF

Name: imagemagick-multiplefunctions-bo(36738)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36738

External Source: VUPEN

Name: ADV-2007-3245

Hyperlink:http://www.vupen.com/english/advisories/2007/3245

External Source: UBUNTU

Name: USN-523-1

Hyperlink:http://www.ubuntu.com/usn/usn-523-1

External Source: SECTRACK

Name: 1018729

Hyperlink:http://www.securitytracker.com/id?1018729

External Source: BUGTRAQ

Name: 20071112 FLEA-2007-0066-1 ImageMagick

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/483572/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0165

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0165.html

External Source: REDHAT

Name: RHSA-2008:0145

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0145.html

External Source: SUSE

Name: SUSE-SR:2007:023

Hyperlink:http://www.novell.com/linux/security/advisories/2007_23_sr.html

External Source: MANDRIVA

Name: MDVSA-2008:035

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035

External Source: CONFIRM

Name: http://www.imagemagick.org/script/changelog.php

Hyperlink:http://www.imagemagick.org/script/changelog.php

External Source: DEBIAN

Name: DSA-1858

Hyperlink:http://www.debian.org/security/2009/dsa-1858

External Source: MLIST

Name: [Magick-announce] 20070917 ImageMagick 6.3.5-9, important security updates

Hyperlink:http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html

External Source: GENTOO

Name: GLSA-200710-27

Hyperlink:http://security.gentoo.org/glsa/glsa-200710-27.xml

External Source: SECUNIA

Name: 36260

Hyperlink:http://secunia.com/advisories/36260

External Source: SECUNIA

Name: 35316

Hyperlink:http://secunia.com/advisories/35316

External Source: SECUNIA

Name: 29857

Hyperlink:http://secunia.com/advisories/29857

External Source: SECUNIA

Name: 29786

Hyperlink:http://secunia.com/advisories/29786

External Source: SECUNIA

Name: 28721

Hyperlink:http://secunia.com/advisories/28721

External Source: SECUNIA

Name: 27439

Hyperlink:http://secunia.com/advisories/27439

External Source: SECUNIA

Name: 27364

Hyperlink:http://secunia.com/advisories/27364

External Source: SECUNIA

Name: 27309

Hyperlink:http://secunia.com/advisories/27309

External Source: SECUNIA

Name: 27048

Hyperlink:http://secunia.com/advisories/27048

External Source: SECUNIA

Name: 26926

Hyperlink:http://secunia.com/advisories/26926

External Source: OVAL

Name: oval:org.mitre.oval:def:9963

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9963

External Source: IDEFENSE

Name: 20070919 Multiple Vendor ImageMagick Multiple Integer Overflow Vulnerabilities

Hyperlink:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=594

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=186030

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=186030

References to Check Content

Identifier:oval:org.mitre.oval:def:9963

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9963