Arch Linux Security Advisory ASA-201610-6 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-7799 CVE-2016-7906 Package : imagemagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 6.9.6.0-1. # pacman -Syu "imagemagick>=6.9.6.0-1" The problems have been fixed upstream in version 6.9.6.0. Workaround ========== None. Description =========== - CVE-2016-7799 (denial of service) A buffer over-read vulnerability was found in ImageMagick. A malicious file could cause the application to crash. - CVE-2016-7906 (arbitrary code execution) An attacker is able to trigger a use-after-free when providing a crafted image to ImageMagick's mogrify function. Impact ====== A remote attacker is able to craft a malicious image to execute arbitrary code or crash the application. References ========== https://github.com/ImageMagick/ImageMagick/commit/a7bb158b7bedd1449a34432feb... http://www.openwall.com/lists/oss-security/2016/10/01/6 https://github.com/ImageMagick/ImageMagick/issues/280 https://github.com/ImageMagick/ImageMagick/issues/281 http://www.openwall.com/lists/oss-security/2016/10/02/3 https://github.com/ImageMagick/ImageMagick/commit/d63a3c5729df59f183e9e110d5... https://access.redhat.com/security/cve/CVE-2016-7799 https://access.redhat.com/security/cve/CVE-2016-7906