CVE Vulnerabilities

CVE-2015-8898

NULL Pointer Dereference

Published: Mar 15, 2017 | Modified: May 18, 2018
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
1.9 LOW
AV:L/AC:M/Au:N/C:N/I:N/A:P
RedHat/V3
Ubuntu
MEDIUM

The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Imagemagick Imagemagick * 6.9.2-3 (including)
Red Hat Enterprise Linux 6 RedHat ImageMagick-0:6.7.2.7-5.el6_8 *
Red Hat Enterprise Linux 7 RedHat ImageMagick-0:6.7.8.9-15.el7_2 *
Imagemagick Ubuntu precise *
Imagemagick Ubuntu trusty *
Imagemagick Ubuntu upstream *
Imagemagick Ubuntu wily *

Potential Mitigations

References