Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ImageMagick may read beyond memory with crafted DDS file

CVE-2016-5687 · published 9 years ago
Summary

ImageMagick versions before 6.9.4-3 and 7.0.1-4 can be sent a specially made DDS image that makes the software read data outside its intended memory area. This could let an attacker disrupt the program or potentially execute code. Update ImageMagick to the latest version or apply the vendor's patch to stop the issue.

What to do
  • Update debian imagemagick to version 8:6.9.6.2+dfsg-2.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian imagemagick < 8:6.9.6.2+dfsg-2
Fix: upgrade to 8:6.9.6.2+dfsg-2
Debian:13 debian imagemagick < 8:6.9.6.2+dfsg-2
Fix: upgrade to 8:6.9.6.2+dfsg-2
Debian:14 debian imagemagick < 8:6.9.6.2+dfsg-2
Fix: upgrade to 8:6.9.6.2+dfsg-2
– imagemagick imagemagick <= 6.9.4-2
7.0.1-0
7.0.1-1
7.0.1-2
7.0.1-3
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
– oracle solaris 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
Original advisory text
The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of...
The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.
References
Severity
9.8 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published13 Dec 2016
Updated3 Nov 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-5687 · OSV
CVE-2016-5687 · NVD
Track software like this
Free during beta