Vulnerability CVE-2018-11624

Vulnerability Name:

CVE-2018-11624 (CCN-144125)

Assigned:

2018-05-29

Published:

2018-05-29

Updated:

2018-06-06

Summary:

In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-416

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-11624

Source: XF
Type: UNKNOWN
imagemagick-cve201811624-dos(144125)

Source: CCN
Type: ImageMagick GIT Repository
heap-use-after-free #1149

Source: MISC
Type: Issue Tracking, Vendor Advisory
https://github.com/ImageMagick/ImageMagick/issues/1149

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-11624

Vulnerable Configuration:

Configuration 1:

cpe:/a:imagemagick:imagemagick:7.0.7-36:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201811624	V	CVE-2018-11624	2023-06-22
oval:org.opensuse.security:def:8055	P	perl-PerlMagick-7.1.0.9-150400.6.18.1 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:7867	P	ImageMagick-7.1.0.9-150400.6.18.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:719	P	Security update for gstreamer-plugins-good (Important)	2022-08-31
oval:org.opensuse.security:def:3251	P	libshibsp-lite6-2.5.5-6.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3420	P	MozillaFirefox-68.1.0-109.92.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:2920	P	firewalld-0.9.3-150400.7.6 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94881	P	ImageMagick-7.1.0.9-150400.4.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2930	P	ghostscript-9.52-161.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95050	P	perl-PerlMagick-7.1.0.9-150400.4.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:1522	P	Security update for mariadb (Important)	2022-06-07
oval:org.opensuse.security:def:1362	P	Security update for the Linux Kernel (Live Patch 3 for SLE 15 SP3) (Important)	2022-05-26
oval:org.opensuse.security:def:1166	P	Security update for openldap2 (Important)	2022-05-16
oval:org.opensuse.security:def:1418	P	Security update for the Linux Kernel (Critical)	2022-02-11
oval:org.opensuse.security:def:1411	P	Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP3) (Important)	2022-02-01
oval:org.opensuse.security:def:910	P	Security update for the Linux Kernel (Important)	2022-01-26
oval:org.opensuse.security:def:1055	P	Security update for SDL2 (Important)	2022-01-18
oval:org.opensuse.security:def:49467	P	Security update for nodejs12 (Important) (in QA)	2022-01-14
oval:org.opensuse.security:def:70029	P	Security update for libsndfile (Important)	2022-01-11
oval:org.opensuse.security:def:93993	P	(Moderate)	2021-12-06
oval:org.opensuse.security:def:1638	P	Security update for util-linux (Moderate)	2021-10-20
oval:org.opensuse.security:def:71206	P	gzip-1.9-2.21 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:71354	P	opie-32bit-2.4-1.96 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:71241	P	libXv-devel-1.0.11-1.23 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:64567	P	Security update for gstreamer-plugins-good (Moderate)	2021-09-02
oval:org.opensuse.security:def:69924	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:47255	P	fontconfig-2.11.1-7.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47984	P	cups-pk-helper-0.2.5-5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47701	P	libdmx1-1.1.3-3.51 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48155	P	libneon27-0.30.0-3.64 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47240	P	dhcp-4.3.3-9.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47446	P	mipv6d-2.0.2.umip.0.4-19.63 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47241	P	dnsmasq-2.76-17.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47892	P	squidGuard-1.4-30.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47569	P	busybox-1.21.1-3.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48346	P	xlockmore-5.43-5.30 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47941	P	SuSEfirewall2-3.6.312.333-3.13.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47431	P	libvte9-0.28.2-19.7 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48301	P	rzsz-0.12.21~rc-1001.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47432	P	libwireshark8-2.2.7-47.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47760	P	libpango-1_0-0-1.40.1-9.5 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47376	P	libmodplug1-0.8.8.4-13.63 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48132	P	libjavascriptcoregtk-4_0-18-2.24.4-2.47.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47793	P	libtag1-1.9.1-1.218 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48239	P	mariadb-10.2.25-3.19.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47567	P	binutils-2.31-9.26.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:2224	P	389-ds-1.4.4.14~git0.37dc95673-1.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2249	P	libecpg6-13.2-5.6.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2282	P	rsyslog-module-gssapi-8.39.0-4.10.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2280	P	redis-6.0.10-1.7.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2240	P	gnuplot-5.2.2-3.6.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2275	P	python3-Twisted-19.10.0-3.2.6 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2236	P	dpdk-19.11.4-1.105 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2269	P	nginx-1.19.8-1.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:62727	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1938	P	ocaml-4.05.0-13.5 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72755	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1954	P	rpm-build-4.14.1-29.46 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72446	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1934	P	libtidy-devel-5.4.0-3.2.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1947	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1952	P	python3-tools-3.6.13-3.78.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100869	P	ldns-devel-1.7.0-4.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1932	P	libpcp-devel-4.3.1-3.11.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1943	P	perl-Config-IniFiles-2.94-1.23 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101133	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63036	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:49442	P	Security update for nodejs14 (Important)	2021-07-14
oval:org.opensuse.security:def:68001	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP1) (Important)	2021-06-18
oval:org.opensuse.security:def:66835	P	Security update for python-rsa (Important)	2021-06-17
oval:org.opensuse.security:def:48722	P	gimp-2.8.10-1.164 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48588	P	pam-1.1.8-14.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48430	P	gnome-keyring-3.20.0-27.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48723	P	gnome-online-accounts-3.10.5-1.11 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48591	P	pam_ssh-2.0-1.39 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48468	P	libXi6-1.7.4-9.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48867	P	libproxy1-networkmanager-32bit-0.4.13-16.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48466	P	libXfixes3-5.0.1-3.52 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:1977	P	osc-0.162.1-1.30 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:71093	P	radvd-2.17-3.18 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48930	P	libmikmod3-3.2.0-4.59 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48366	P	apache-commons-daemon-1.0.15-4.181 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48659	P	yast2-users-3.1.57-16.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48449	P	java-1_7_0-openjdk-1.7.0.111-33.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48397	P	cvs-1.12.12-181.54 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48492	P	libfreebl3-3.21.1-46.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48741	P	libproxy1-networkmanager-32bit-0.4.11-11.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48450	P	java-1_8_0-openjdk-1.8.0.101-14.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48557	P	libtasn1-3.7-11.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48789	P	libgio-fam-2.48.2-10.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:64506	P	Security update for libu2f-host (Moderate)	2021-05-25
oval:org.opensuse.security:def:1982	P	java-1_8_0-ibm-1.8.0_sr5.30-3.16.2 on GA media (Moderate)	2021-04-29
oval:org.opensuse.security:def:1989	P	reiserfs-kmp-default-4.12.14-195.1 on GA media (Moderate)	2021-04-29
oval:org.opensuse.security:def:1987	P	openldap2-2.4.46-9.3.1 on GA media (Moderate)	2021-04-29
oval:org.opensuse.security:def:67753	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15) (Important)	2021-04-28
oval:org.opensuse.security:def:66743	P	Security update for clamav-database (Important)	2021-04-19
oval:org.opensuse.security:def:94156	P	(Important)	2021-04-01
oval:org.opensuse.security:def:64654	P	Security update for avahi (Moderate)	2021-02-23
oval:org.opensuse.security:def:100706	P	(Important)	2021-02-11
oval:org.opensuse.security:def:72330	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:89850	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1888	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103654	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:116930	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62920	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:49024	P	libosip2-3.5.0-20.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2214	P	skopeo-0.1.41-4.11.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:89999	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62500	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107372	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117093	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62977	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72639	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2209	P	rarpd-s20161105-6.10 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62611	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72219	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107535	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1960	P	libpmi0-17.11.5-4.28 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72696	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2205	P	postgresql10-contrib-10.12-8.13.10 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1831	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103505	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2637	P	Security update for ImageMagick (Moderate)	2020-12-02
oval:org.opensuse.security:def:2627	P	Security update for slirp4netns (Important)	2020-12-02
oval:org.opensuse.security:def:49178	P	libjasper4 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49734	P	cups-ddk on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49496	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70086	P	libexiv2-26 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49565	P	libnetpbm-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64419	P	mutt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73246	P	libwscodecs1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51072	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:73526	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49630	P	gnome-desktop-lang on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49070	P	coreutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49805	P	perl-YAML-LibYAML on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66673	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50027	P	python3-pywbem on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49607	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49661	P	libdjvulibre-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49858	P	perl-Net-Libproxy on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49498	P	NetworkManager on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73408	P	libXinerama1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51365	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:49923	P	python2-paramiko on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:67901	P	libcdio++0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51010	P	Security update for tcpdump (Moderate)	2020-12-01
oval:org.opensuse.security:def:49803	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49310	P	python3-SQLAlchemy on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49954	P	libecpg6 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66581	P	p7zip on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49791	P	nasm on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49553	P	libjasper-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70191	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49409	P	gnome-settings-daemon on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51303	P	Security update for wireshark (Moderate)	2020-12-01
oval:org.opensuse.security:def:67853	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49859	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73364	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49214	P	libpcre2-16-0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49749	P	ocaml-libguestfs-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49701	P	libvdpau-devel on GA media (Moderate)	2020-12-01
oval:com.ubuntu.artful:def:201811624000	V	CVE-2018-11624 on Ubuntu 17.10 (artful) - medium.	2018-05-31
oval:com.ubuntu.bionic:def:201811624000	V	CVE-2018-11624 on Ubuntu 18.04 LTS (bionic) - medium.	2018-05-31
oval:com.ubuntu.bionic:def:2018116240000000	V	CVE-2018-11624 on Ubuntu 18.04 LTS (bionic) - medium.	2018-05-31
oval:com.ubuntu.trusty:def:201811624000	V	CVE-2018-11624 on Ubuntu 14.04 LTS (trusty) - medium.	2018-05-31
oval:com.ubuntu.xenial:def:2018116240000000	V	CVE-2018-11624 on Ubuntu 16.04 LTS (xenial) - medium.	2018-05-31
oval:com.ubuntu.xenial:def:201811624000	V	CVE-2018-11624 on Ubuntu 16.04 LTS (xenial) - medium.	2018-05-31

BACK