Vulnerability CVE-2018-16641

Vulnerability Name:

CVE-2018-16641 (CCN-149691)

Assigned:

2018-07-12

Published:

2018-07-12

Updated:

2019-10-03

Summary:

ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-772

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-16641

Source: XF
Type: UNKNOWN
imagemagick-cve201816641-dos(149691)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/256825d4eb33dc301496710d15cf5a7ae924088b

Source: CCN
Type: ImageMagick GIT Repository
There is a potential memory leak in codes/tiff.c #1206

Source: MISC
Type: Exploit, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1206

Vulnerable Configuration:

Configuration 1:

cpe:/a:imagemagick:imagemagick:7.0.8-6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:imagemagick:imagemagick:7.0.8-6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201816641	V	CVE-2018-16641	2023-06-22
oval:org.opensuse.security:def:8055	P	perl-PerlMagick-7.1.0.9-150400.6.18.1 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:7867	P	ImageMagick-7.1.0.9-150400.6.18.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:719	P	Security update for gstreamer-plugins-good (Important)	2022-08-31
oval:org.opensuse.security:def:3251	P	libshibsp-lite6-2.5.5-6.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3420	P	MozillaFirefox-68.1.0-109.92.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:2943	P	grub2-2.06-150400.9.9 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94881	P	ImageMagick-7.1.0.9-150400.4.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2933	P	glib-networking-2.70.1-150400.1.6 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95050	P	perl-PerlMagick-7.1.0.9-150400.4.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:1522	P	Security update for mariadb (Important)	2022-06-07
oval:org.opensuse.security:def:1362	P	Security update for the Linux Kernel (Live Patch 3 for SLE 15 SP3) (Important)	2022-05-26
oval:org.opensuse.security:def:1166	P	Security update for openldap2 (Important)	2022-05-16
oval:org.opensuse.security:def:1418	P	Security update for the Linux Kernel (Critical)	2022-02-11
oval:org.opensuse.security:def:1411	P	Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP3) (Important)	2022-02-01
oval:org.opensuse.security:def:910	P	Security update for the Linux Kernel (Important)	2022-01-26
oval:org.opensuse.security:def:1055	P	Security update for SDL2 (Important)	2022-01-18
oval:org.opensuse.security:def:111894	P	ImageMagick-7.1.0.9-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:70029	P	Security update for libsndfile (Important)	2022-01-11
oval:org.opensuse.security:def:93993	P	(Moderate)	2021-12-06
oval:org.opensuse.security:def:1638	P	Security update for util-linux (Moderate)	2021-10-20
oval:org.opensuse.security:def:71206	P	gzip-1.9-2.21 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:71354	P	opie-32bit-2.4-1.96 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:71241	P	libXv-devel-1.0.11-1.23 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:64567	P	Security update for gstreamer-plugins-good (Moderate)	2021-09-02
oval:org.opensuse.security:def:69924	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:47446	P	mipv6d-2.0.2.umip.0.4-19.63 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47241	P	dnsmasq-2.76-17.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47892	P	squidGuard-1.4-30.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47569	P	busybox-1.21.1-3.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48346	P	xlockmore-5.43-5.30 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47941	P	SuSEfirewall2-3.6.312.333-3.13.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47431	P	libvte9-0.28.2-19.7 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48301	P	rzsz-0.12.21~rc-1001.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47432	P	libwireshark8-2.2.7-47.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47760	P	libpango-1_0-0-1.40.1-9.5 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47376	P	libmodplug1-0.8.8.4-13.63 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48132	P	libjavascriptcoregtk-4_0-18-2.24.4-2.47.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47793	P	libtag1-1.9.1-1.218 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48239	P	mariadb-10.2.25-3.19.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47567	P	binutils-2.31-9.26.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47255	P	fontconfig-2.11.1-7.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47984	P	cups-pk-helper-0.2.5-5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47701	P	libdmx1-1.1.3-3.51 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48155	P	libneon27-0.30.0-3.64 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47240	P	dhcp-4.3.3-9.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:2227	P	apache2-mod_auth_openidc-2.3.8-3.7.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2253	P	libmariadbd-devel-10.5.8-1.5 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:1968	P	libmunge2-0.5.14-11.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2288	P	squid-4.13-5.23.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2249	P	libecpg6-13.2-5.6.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2282	P	rsyslog-module-gssapi-8.39.0-4.10.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2005	P	libicu60_2-60.2-3.9.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2003	P	java-1_8_0-openjdk-1.8.0.282-3.48.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2237	P	erlang-rabbitmq-client-3.8.11-1.26 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2262	P	libtcmu2-1.5.2-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2295	P	vsftpd-3.0.3-7.16.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:1970	P	python2-numpy-gnu-hpc-1.16.5-1.164 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2293	P	uuidd-2.36.2-2.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:62727	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1950	P	perl-solv-0.7.19-3.20.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72755	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72446	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1948	P	perl-YAML-LibYAML-0.69-3.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1947	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1959	P	zlib-devel-32bit-1.2.11-3.21.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100869	P	ldns-devel-1.7.0-4.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101133	P	ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1954	P	rpm-build-4.14.1-29.46 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63036	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:49442	P	Security update for nodejs14 (Important)	2021-07-14
oval:org.opensuse.security:def:68001	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP1) (Important)	2021-06-18
oval:org.opensuse.security:def:66835	P	Security update for python-rsa (Important)	2021-06-17
oval:org.opensuse.security:def:48468	P	libXi6-1.7.4-9.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48880	P	pidgin-plugin-otr-4.0.2-1.29 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48482	P	libarchive13-3.1.2-22.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:71093	P	radvd-2.17-3.18 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48946	P	libreoffice-6.0.5.2-43.38.5 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48366	P	apache-commons-daemon-1.0.15-4.181 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48659	P	yast2-users-3.1.57-16.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48465	P	libXext6-1.3.2-3.60 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48397	P	cvs-1.12.12-181.54 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48492	P	libfreebl3-3.21.1-46.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48754	P	pulseaudio-module-bluetooth-5.0-2.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48466	P	libXfixes3-5.0.1-3.52 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:1976	P	openldap2-2.4.46-7.10 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48557	P	libtasn1-3.7-11.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48805	P	libuuid-devel-2.28-40.28 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48735	P	libid3tag0-0.15.1b-182.58 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48588	P	pam-1.1.8-14.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48430	P	gnome-keyring-3.20.0-27.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48736	P	libjavascriptcoregtk-1_0-0-2.4.8-16.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48607	P	python-libxml2-2.9.4-27.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:64506	P	Security update for libu2f-host (Moderate)	2021-05-25
oval:org.opensuse.security:def:67753	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15) (Important)	2021-04-28
oval:org.opensuse.security:def:66743	P	Security update for clamav-database (Important)	2021-04-19
oval:org.opensuse.security:def:94156	P	(Important)	2021-04-01
oval:org.opensuse.security:def:49083	P	Security update for salt (Critical)	2021-02-26
oval:org.opensuse.security:def:64654	P	Security update for avahi (Moderate)	2021-02-23
oval:org.opensuse.security:def:100706	P	(Important)	2021-02-11
oval:org.opensuse.security:def:51088	P	Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP2) (Important)	2020-12-07
oval:org.opensuse.security:def:49040	P	libvdpau1-32bit-1.1.1-6.73 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72330	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:89850	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1888	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103654	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:116930	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1993	P	libcgroup-devel-0.41.rc1-1.10.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62920	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:89999	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2222	P	xen-4.13.1_02-1.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62500	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107372	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117093	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62977	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72639	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2218	P	sysstat-isag-12.0.2-3.21.18 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62611	P	ImageMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72219	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107535	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72696	P	perl-PerlMagick-7.0.7.34-8.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1831	P	perl-PerlMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103505	P	ImageMagick-7.0.7.34-3.54.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1998	P	pam-modules-12.1-3.17 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2653	P	Security update for ImageMagick (Low)	2020-12-02
oval:org.opensuse.security:def:2643	P	Security update for ffmpeg (Moderate)	2020-12-02
oval:org.opensuse.security:def:49480	P	perl-File-Path on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50040	P	uuidd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49607	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49677	P	libmicrohttpd-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49871	P	libpmi0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49514	P	gcab on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73408	P	libXinerama1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51378	P	Security update for ImageMagick (Low)	2020-12-01
oval:org.opensuse.security:def:49936	P	apache2-mod_apparmor on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:67901	P	libcdio++0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51026	P	Security update for mutt (Important)	2020-12-01
oval:org.opensuse.security:def:49803	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49323	P	rpcbind on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49967	P	memcached on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66581	P	p7zip on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49804	P	perl-Tk-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49553	P	libjasper-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70191	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49425	P	libXrandr2-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51316	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:67853	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49859	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73364	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49227	P	librsync-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49749	P	ocaml-libguestfs-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49714	P	rtkit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49194	P	libminizip1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49750	P	openldap2-devel-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49496	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:70086	P	libexiv2-26 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49581	P	libtiff5-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64419	P	mutt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73246	P	libwscodecs1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73526	P	perl-PerlMagick on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49646	P	libQt5OpenGLExtensions-devel-static on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49805	P	perl-YAML-LibYAML on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66673	P	ImageMagick on GA media (Moderate)	2020-12-01
oval:com.ubuntu.bionic:def:201816641000	V	CVE-2018-16641 on Ubuntu 18.04 LTS (bionic) - negligible.	2018-09-06
oval:com.ubuntu.bionic:def:2018166410000000	V	CVE-2018-16641 on Ubuntu 18.04 LTS (bionic) - negligible.	2018-09-06
oval:com.ubuntu.trusty:def:201816641000	V	CVE-2018-16641 on Ubuntu 14.04 LTS (trusty) - negligible.	2018-09-06
oval:com.ubuntu.xenial:def:2018166410000000	V	CVE-2018-16641 on Ubuntu 16.04 LTS (xenial) - negligible.	2018-09-06
oval:com.ubuntu.xenial:def:201816641000	V	CVE-2018-16641 on Ubuntu 16.04 LTS (xenial) - negligible.	2018-09-06

BACK