CVE-2018-6799

moderate-risk

Published 2018-02-07

The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.

Do I need to act?

0.78% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (4)

Graphicsmagick

Debian Linux

Affected Vendors

Debian Graphicsmagick

References (14)

Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b41e2efce6d3

Third Party Advisory http://www.securityfocus.com/bid/102981

Mailing List https://lists.debian.org/debian-lts-announce/2018/02/msg00017.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://www.debian.org/security/2018/dsa-4321

Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b41e2efce6d3

Third Party Advisory http://www.securityfocus.com/bid/102981

Mailing List https://lists.debian.org/debian-lts-announce/2018/02/msg00017.html

Mailing List https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://www.debian.org/security/2018/dsa-4321

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 3/34 · Minimal

Exposure 10/34 · Low