CVE-2018-20467

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name	Vendor	Start Version	End Version
Imagemagick	Imagemagick	*	6.9.10-16 (excluding)
Imagemagick	Imagemagick	7.0.0-0 (including)	7.0.8-16 (excluding)
Red Hat Enterprise Linux 7	RedHat	autotrace-0:0.31.1-38.el7	*
Red Hat Enterprise Linux 7	RedHat	emacs-1:24.3-23.el7	*
Red Hat Enterprise Linux 7	RedHat	ImageMagick-0:6.9.10.68-3.el7	*
Red Hat Enterprise Linux 7	RedHat	inkscape-0:0.92.2-3.el7	*
Imagemagick	Ubuntu	bionic	*
Imagemagick	Ubuntu	cosmic	*
Imagemagick	Ubuntu	disco	*
Imagemagick	Ubuntu	esm-infra-legacy/trusty	*
Imagemagick	Ubuntu	esm-infra/bionic	*
Imagemagick	Ubuntu	esm-infra/xenial	*
Imagemagick	Ubuntu	trusty	*
Imagemagick	Ubuntu	trusty/esm	*
Imagemagick	Ubuntu	upstream	*
Imagemagick	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-20467
CWE	https://cwe.mitre.org/data/definitions/835.html

Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

Affected Software

References