リモートの Windows ホストにインストールされている ImageMagick のバージョンは、7.0.8-25より前の7.xです。そのため、以下の複数の脆弱性の影響を受けます。

  - A denial of service (DoS) vulnerability exists in coders/pcd.c due to a memory leak in DecodeImage. 認証されていないリモート攻撃者がこれを悪用し、アプリケーションの応答を停止させる可能性があります。(CVE-2019-7175)

  - A denial of service (DoS) vulnerability exists in coders/png.c due to a missing null check, a memory leak. An unauthenticated, remote attacker can exploit this issue, via null PNG Images, to cause the application to stop responding. (CVE-2018-16749) (CVE-2019-7395)

  - A denial of service (DoS) vulnerability exists in coders/sixel.c due to a memory leak in ReadSIXELImage. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding.(CVE-2019-7396)

  - A denial of service (DoS) vulnerability exists in coders/pdf.c due to a memory leak in WritePDFImage. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding.(CVE-2019-7397)

  - A denial of service (DoS) vulnerability exists in coders/dib.c due to a memory leak in WriteDIBImage. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding.(CVE-2019-7397)

.

検出

ImageMagick < 7.0.8-25の複数の脆弱性

high Nessus プラグイン ID 122248

バージョン 1.7

バージョン 1.6

バージョン 1.7 Jun 21, 2024, 2:16 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202406211416
バージョン 1.6 Jun 4, 2024, 12:08 PM Logic Changes (removed vcf_extras) New Plugin Feed: 202406041208