发布时间: 2025年9月5日
修改时间: 2025年9月12日
A vulnerability was found in ImageMagick up to 6.9.13-27/7.1.2-1 on 32-bit (Image Processing Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and availability.Upgrading to version 6.9.13-28 or 7.1.2-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2c55221f4d38193adcb51056c14cf238fbcc35d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
| NVD | openEuler | |
|---|---|---|
| Confidentiality | High | High |
| Attack Vector | Network | Network |
| CVSS评分 | 8.8 | 7.5 |
| Attack Complexity | Low | High |
| Privileges Required | Low | Low |
| Scope | Unchanged | Unchanged |
| Integrity | High | High |
| User Interaction | None | None |
| Availability | High | High |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2025-2853 | ImageMagick security update | 2025年9月24日 |
| KylinSec-SA-2025-2871 | ImageMagick security update | 2025年9月15日 |
| KylinSec-SA-2025-2895 | ImageMagick security update | 2025年9月18日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-5A | ImageMagick | Fixed |
| V6 | ImageMagick | Fixed |
| KY3.5.3 | ImageMagick | Fixed |
| KY3.5.2 | ImageMagick | Fixed |
