Vulnerability Details : CVE-2016-9830
The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2016-9830
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.25:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9830
0.60%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9830
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2016-9830
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-9830
-
http://www.openwall.com/lists/oss-security/2016/12/05/5
oss-security - Re: graphicsmagick: memory allocation failure in MagickRealloc (memory.c)Mailing List;Third Party Advisory
-
http://www.debian.org/security/2016/dsa-3746
Debian -- Security Information -- DSA-3746-1 graphicsmagickThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1401536
1401536 – (CVE-2016-9830) CVE-2016-9830 GraphicsMagick: Memory allocation failure in MagickReallocIssue Tracking;Patch
-
https://blogs.gentoo.org/ago/2016/12/01/graphicsmagick-memory-allocation-failure-in-magickrealloc-memory-c
graphicsmagick: memory allocation failure in MagickRealloc (memory.c) | agostino's blogPatch;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/94625
GraphicsMagick 'memory.c' Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
http://hg.code.sf.net/p/graphicsmagick/code/rev/38d0f281e8c8
Mercurial Repository: p/graphicsmagick/code: changeset 14953:38d0f281e8c8Issue Tracking;Patch;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2016-12/msg00141.html
openSUSE-SU-2016:3238-1: moderate: Security update for GraphicsMagickThird Party Advisory
Jump to