Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-10144: ImageMagick: Missing Check Allows Unspecific Impact

CVE-2016-10144 · published 9 years ago

Summary

A flaw in ImageMagick's handling of certain image files could allow attackers to potentially cause unexpected behavior. This issue affects ImageMagick, a popular image processing tool used by many websites and applications. To mitigate this issue, ensure you are running the latest version of ImageMagick.

What to do

Update imagemagick imagemagick to version 6.9.7-1 or later.

Affected software

Vendor	Product	Affected versions
imagemagick	imagemagick	< 6.9.7-1 `cpe:2.3:a:imagemagick:imagemagick::::::::`

Original advisory text

coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.

References

http://www.debian.org/security/2017/dsa-3799 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/16/6 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/17/5 Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/95750 Third Party Advisory VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851485 Issue Tracking Patch Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/97566cf2806c0a5a86e884c96831a0... Issue Tracking Patch Third Party Advisory
https://security.gentoo.org/glsa/201702-09 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published24 Mar 2017

Updated25 Oct 2026

First seen2 Apr 2026

Sources

CVE-2016-10144 · OSV

CVE-2016-10144 · NVD

Track software like this

Free during beta