ImageMagick Multiple Denial of Service Vulnerabilities

http://www.securityfocus.com/bid/52898

Security Info

Bugtraq ID:	52898
Class:	Unknown
CVE:	CVE-2012-0259 CVE-2012-0260 CVE-2012-1610 CVE-2012-1798
Remote:	Yes
Local:	No
Published:	Apr 05 2012 12:00AM
Updated:	Apr 05 2012 12:00AM
Credit:	Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa of Codenomicon CROSS Project and Red Hat Security Response
Vulnerable:	ImageMagick ImageMagick 6.7.6-2

Not Vulnerable:	ImageMagick ImageMagick 6.7.6-4

Security Discussion

ImageMagick is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to cause an affected application to crash, denying service to legitimate users.

ImageMagick versions prior to 6.7.6-4 are vulnerable.

Proof of Concept and Security Exploits

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

CERT-FI Advisory on issues in ImageMagick (CERT-FI)
CVE-2012-1610 assignment notification: ImageMagick insufficient patch for CVE-20 (Red Hat Security Response)
ImageMagick Homepage (ImageMagick)
ImageMagick Vulnerabilities (ImageMagick )

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services