Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2015-8959: ImageMagick may become unresponsive when processing crafted DDS files
CVE-2015-8959 · published 9 years ago
Summary
Older versions of ImageMagick, the program used to edit and display images, can be forced to use a lot of computer power and stop responding if they open a specially made DDS image file. This can affect any system that automatically processes images from external sources. Upgrade to the latest ImageMagick release or apply the available patch, and avoid opening DDS files from untrusted sources.
What to do
- Update debian imagemagick to version 8:6.9.6.2+dfsg-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | imagemagick |
< 8:6.9.6.2+dfsg-2 Fix: upgrade to 8:6.9.6.2+dfsg-2
|
| Debian:13 | debian | imagemagick |
< 8:6.9.6.2+dfsg-2 Fix: upgrade to 8:6.9.6.2+dfsg-2
|
| Debian:14 | debian | imagemagick |
< 8:6.9.6.2+dfsg-2 Fix: upgrade to 8:6.9.6.2+dfsg-2
|
| – | imagemagick | imagemagick |
<= 6.9.0-3 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
Original advisory text
coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
References
- https://security-tracker.debian.org/tracker/CVE-2015-8959 Vendor Advisory
- http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26861 Exploit Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/09/22/2 Mailing List Patch Third Party Advisory
- http://www.securityfocus.com/bid/93230 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1378738 Issue Tracking Patch
- https://github.com/ImageMagick/ImageMagick/commit/3ab016764c7f787829d9065440d86f... Issue Tracking Patch Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/9b428b7af688fe319320aed15f2b94... Issue Tracking Patch Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/cc2a4d2ba5371d25c58763e4db2dbc... Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-399Resource Management Errors
Timeline
Published20 Apr 2017
Updated4 Nov 2026
First seen9 Sep 2026
Track software like this
Free during beta