Detections
Analytics
Mandriva Linux Security Advisory : ImageMagick (MDVSA-2008:099)
medium Nessus Plugin ID 37739
Synopsis
The remote Mandriva Linux host is missing one or more security updates.Description
A heap-based buffer overflow vulnerability was found in how ImageMagick parsed XCF files. If ImageMagick opened a specially crafted XCF file, it could be made to overwrite heap memory beyond the bounds of its allocated memory, potentially allowing an attacker to execute arbitrary code on the system running ImageMagick (CVE-2008-1096).Another heap-based buffer overflow vulnerability was found in how ImageMagick processed certain malformed PCX images. If ImageMagick opened a specially crafted PCX image file, an attacker could possibly execute arbitrary code on the system running ImageMagick (CVE-2008-1097).
The updated packages have been patched to correct these issues.
Solution
Update the affected packages.Plugin Details
Severity: Medium
ID: 37739
File Name: mandriva_MDVSA-2008-099.nasl
Version: 1.17
Type: local
Family: Mandriva Local Security Checks
Published: 4/23/2009
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:imagemagick, p-cpe:/a:mandriva:linux:imagemagick-desktop, p-cpe:/a:mandriva:linux:imagemagick-doc, p-cpe:/a:mandriva:linux:lib64magick10.7.0, p-cpe:/a:mandriva:linux:lib64magick10.7.0-devel, p-cpe:/a:mandriva:linux:libmagick10.7.0, p-cpe:/a:mandriva:linux:libmagick10.7.0-devel, p-cpe:/a:mandriva:linux:perl-image-magick, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 5/8/2008
Reference Information
CVE: CVE-2008-1096, CVE-2008-1097