8.8

CVE-2014-1958

Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Imagemagick ≫ Imagemagick Version < 6.8.8-5
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 12.10
Canonical ≫ Ubuntu Linux Version 13.10
Opensuse ≫ Opensuse Version 11.4
Opensuse ≫ Opensuse Version 12.3
Opensuse ≫ Opensuse Version 13.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.54% 0.878
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html
Third Party Advisory
Mailing List
http://trac.imagemagick.org/changeset/14801
Broken Link
http://ubuntu.com/usn/usn-2132-1
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/02/13/2
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2014/02/13/5
Third Party Advisory
Mailing List
https://www.openwall.com/lists/oss-security/2014/02/19/13
Third Party Advisory
Mailing List