Vulnerability in Imagemagick
CVE-2006-0082
Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program.
EPSS: 0.043 (90.2th percentile) — read the EPSS interpretation.
Affected products
- Imagemagick — versions 6.2.3
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (x_refsource_OVAL, signature, vdb-entry)
- security@debian.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- security@debian.org (mailing-list, x_refsource_BUGTRAQ)
- security@debian.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security@debian.org (vendor-advisory, x_refsource_SUSE)
- security@debian.org (vendor-advisory, Patch, x_refsource_SLACKWARE)
- security@debian.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- security@debian.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- security@debian.org (vendor-advisory, x_refsource_MANDRIVA)
- security@debian.org (vendor-advisory, Patch, x_refsource_GENTOO, Vendor Advisory)