CVE Vulnerabilities

CVE-2018-20467

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Dec 26, 2018 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
5.3 LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ubuntu
LOW

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Imagemagick Imagemagick * 6.9.10-16 (excluding)
Imagemagick Imagemagick 7.0.0-0 (including) 7.0.8-16 (excluding)
Red Hat Enterprise Linux 7 RedHat autotrace-0:0.31.1-38.el7 *
Red Hat Enterprise Linux 7 RedHat emacs-1:24.3-23.el7 *
Red Hat Enterprise Linux 7 RedHat ImageMagick-0:6.9.10.68-3.el7 *
Red Hat Enterprise Linux 7 RedHat inkscape-0:0.92.2-3.el7 *
Imagemagick Ubuntu bionic *
Imagemagick Ubuntu cosmic *
Imagemagick Ubuntu disco *
Imagemagick Ubuntu trusty *
Imagemagick Ubuntu trusty/esm *
Imagemagick Ubuntu upstream *
Imagemagick Ubuntu xenial *

References