In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Imagemagick | Imagemagick | * | 6.9.9-2 (including) |
| Imagemagick | Imagemagick | 7.0.1-0 (including) | 7.0.1-0 (including) |
| Imagemagick | Imagemagick | 7.0.1-1 (including) | 7.0.1-1 (including) |
| Imagemagick | Imagemagick | 7.0.1-2 (including) | 7.0.1-2 (including) |
| Imagemagick | Imagemagick | 7.0.1-3 (including) | 7.0.1-3 (including) |
| Imagemagick | Imagemagick | 7.0.1-4 (including) | 7.0.1-4 (including) |
| Imagemagick | Imagemagick | 7.0.1-5 (including) | 7.0.1-5 (including) |
| Imagemagick | Imagemagick | 7.0.1-6 (including) | 7.0.1-6 (including) |
| Imagemagick | Imagemagick | 7.0.1-7 (including) | 7.0.1-7 (including) |
| Imagemagick | Imagemagick | 7.0.1-8 (including) | 7.0.1-8 (including) |
| Imagemagick | Imagemagick | 7.0.1-9 (including) | 7.0.1-9 (including) |
| Imagemagick | Imagemagick | 7.0.1-10 (including) | 7.0.1-10 (including) |
| Imagemagick | Imagemagick | 7.0.2-0 (including) | 7.0.2-0 (including) |
| Imagemagick | Imagemagick | 7.0.2-1 (including) | 7.0.2-1 (including) |
| Imagemagick | Imagemagick | 7.0.2-2 (including) | 7.0.2-2 (including) |
| Imagemagick | Imagemagick | 7.0.2-3 (including) | 7.0.2-3 (including) |
| Imagemagick | Imagemagick | 7.0.2-4 (including) | 7.0.2-4 (including) |
| Imagemagick | Imagemagick | 7.0.2-5 (including) | 7.0.2-5 (including) |
| Imagemagick | Imagemagick | 7.0.2-6 (including) | 7.0.2-6 (including) |
| Imagemagick | Imagemagick | 7.0.2-7 (including) | 7.0.2-7 (including) |
| Imagemagick | Imagemagick | 7.0.2-8 (including) | 7.0.2-8 (including) |
| Imagemagick | Imagemagick | 7.0.2-9 (including) | 7.0.2-9 (including) |
| Imagemagick | Imagemagick | 7.0.2-10 (including) | 7.0.2-10 (including) |
| Imagemagick | Imagemagick | 7.0.3-0 (including) | 7.0.3-0 (including) |
| Imagemagick | Imagemagick | 7.0.3-1 (including) | 7.0.3-1 (including) |
| Imagemagick | Imagemagick | 7.0.3-2 (including) | 7.0.3-2 (including) |
| Imagemagick | Imagemagick | 7.0.3-3 (including) | 7.0.3-3 (including) |
| Imagemagick | Imagemagick | 7.0.3-4 (including) | 7.0.3-4 (including) |
| Imagemagick | Imagemagick | 7.0.3-5 (including) | 7.0.3-5 (including) |
| Imagemagick | Imagemagick | 7.0.3-6 (including) | 7.0.3-6 (including) |
| Imagemagick | Imagemagick | 7.0.3-7 (including) | 7.0.3-7 (including) |
| Imagemagick | Imagemagick | 7.0.3-8 (including) | 7.0.3-8 (including) |
| Imagemagick | Imagemagick | 7.0.3-9 (including) | 7.0.3-9 (including) |
| Imagemagick | Imagemagick | 7.0.3-10 (including) | 7.0.3-10 (including) |
| Imagemagick | Imagemagick | 7.0.4-0 (including) | 7.0.4-0 (including) |
| Imagemagick | Imagemagick | 7.0.4-1 (including) | 7.0.4-1 (including) |
| Imagemagick | Imagemagick | 7.0.4-2 (including) | 7.0.4-2 (including) |
| Imagemagick | Imagemagick | 7.0.4-3 (including) | 7.0.4-3 (including) |
| Imagemagick | Imagemagick | 7.0.4-4 (including) | 7.0.4-4 (including) |
| Imagemagick | Imagemagick | 7.0.4-5 (including) | 7.0.4-5 (including) |
| Imagemagick | Imagemagick | 7.0.4-6 (including) | 7.0.4-6 (including) |
| Imagemagick | Imagemagick | 7.0.4-7 (including) | 7.0.4-7 (including) |
| Imagemagick | Imagemagick | 7.0.4-8 (including) | 7.0.4-8 (including) |
| Imagemagick | Imagemagick | 7.0.4-9 (including) | 7.0.4-9 (including) |
| Imagemagick | Imagemagick | 7.0.4-10 (including) | 7.0.4-10 (including) |
| Imagemagick | Imagemagick | 7.0.5-0 (including) | 7.0.5-0 (including) |
| Imagemagick | Imagemagick | 7.0.5-1 (including) | 7.0.5-1 (including) |
| Imagemagick | Imagemagick | 7.0.5-4 (including) | 7.0.5-4 (including) |
| Imagemagick | Imagemagick | 7.0.5-5 (including) | 7.0.5-5 (including) |
| Imagemagick | Imagemagick | 7.0.5-6 (including) | 7.0.5-6 (including) |
| Imagemagick | Imagemagick | 7.0.5-7 (including) | 7.0.5-7 (including) |
| Imagemagick | Imagemagick | 7.0.5-8 (including) | 7.0.5-8 (including) |
| Imagemagick | Imagemagick | 7.0.5-9 (including) | 7.0.5-9 (including) |
| Imagemagick | Imagemagick | 7.0.5-10 (including) | 7.0.5-10 (including) |
| Imagemagick | Imagemagick | 7.0.6-0 (including) | 7.0.6-0 (including) |
| Imagemagick | Imagemagick | 7.0.6-1 (including) | 7.0.6-1 (including) |
| Imagemagick | Imagemagick | 7.0.6-2 (including) | 7.0.6-2 (including) |
| Imagemagick | Ubuntu | upstream | * |
| Imagemagick | Ubuntu | zesty | * |
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.