In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.

This update fixes several vulnerabilities in Imagemagick, a graphical software suite. Various memory handling problems or incomplete input sanitising could result in denial of service or the execution of arbitrary code.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3681-1 advisory.

    It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or     automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could     exploit this to cause a denial of service or possibly execute code with the privileges of the user     invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several vulnerabilities in imagemagick, a graphical software suite. Various memory handling problems or issues about incomplete input sanitizing would result in denial of service or memory disclosure.

ID	Name	Product	Family	Severity
111088	Debian DSA-4245-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high
110516	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ImageMagick vulnerabilities (USN-3681-1)	Nessus	Ubuntu Local Security Checks	critical
109925	Debian DSA-4204-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-5248

high

Tenable Plugins

high

critical

high