CVE-2014-1958

moderate-risk
Published 2020-02-06

Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.

Do I need to act?

-
0.93% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (7)

Affected Vendors

Imagemagick Canonical Opensuse

References (14)

Mailing List http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html
Mailing List http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html
Broken Link http://trac.imagemagick.org/changeset/14801
Third Party Advisory http://ubuntu.com/usn/usn-2132-1
Mailing List http://www.openwall.com/lists/oss-security/2014/02/13/2
Mailing List http://www.openwall.com/lists/oss-security/2014/02/13/5
Mailing List https://www.openwall.com/lists/oss-security/2014/02/19/13
Mailing List http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html
Mailing List http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html
Broken Link http://trac.imagemagick.org/changeset/14801
Third Party Advisory http://ubuntu.com/usn/usn-2132-1
Mailing List http://www.openwall.com/lists/oss-security/2014/02/13/2
Mailing List http://www.openwall.com/lists/oss-security/2014/02/13/5
Mailing List https://www.openwall.com/lists/oss-security/2014/02/19/13
47
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 3/34 · Minimal
Exposure 14/34 · Moderate