Description (CNA)
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ImageMagick / ImageMagick | affected < 6.9.13-48; affected < 7.1.2-22 |
CWE
CWE-125, CWE-129
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in ImageMagick. A local attacker could exploit this vulnerability by providing an invalid 'connected-components:keep-top' value during image processing. This could lead to a heap buffer over-read, potentially resulting in information disclosure or a denial of service (DoS).