リモートのWindowsホストにインストールされているImageMagickのバージョンは、6.9.7-8より前の6.xか7.0.4-8より前の7.xです。このため、複数のサービス拒否脆弱性の影響を受けます。

  - A NULL pointer dereference flaw exists in the ReadPSDChannel() function in coders/psd.c due to improper handling of PSD files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted PSD file, to cause a denial of service condition. (CVE-2017-6497)

  - A flaw exists in Magick++/lib/Exception.cpp due to improper handling of nested exceptions. 認証されていないリモートの攻撃者がこの脆弱性を悪用し、アプリケーションにリソースを過剰に消費させ、サービス拒否状態を引き起こす可能性があります。
    (CVE-2017-6499)

  - A NULL pointer dereference flaw exists in the ReadXCFImage() function in coders/xcf.c due to improper handling of XCF files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted XCF file, to cause a denial of service condition. (CVE-2017-6501)

詳細については、CVE/URLリストを参照してください。

遠端 Windows 主機上安裝的 ImageMagick 版本是 6.9.7-8 之前的 6.x 版，或是 7.0.4-8 之前的 7.x 版。因此受到多個拒絕服務弱點影響：- coders/psd.c 中的 ReadPSDChannel() 函式存在一個 NULL 指標解除參照缺陷，這是因為不當處理 PSD 檔案所致。未經驗證的遠端攻擊者可加以惡意利用，誘騙使用者開啟特製 PSD 檔案，造成拒絕服務情形。(CVE-2017-6497) - 在 Magick++/lib/Exception.cpp 中存在一個缺陷，這是因為不當處理巢狀異常所致。未經驗證的遠端攻擊者可加以惡意利用，造成應用程式消耗過量資源，進而導致拒絕服務情形。(CVE-2017-6499) - coders/xcf.c 中的 ReadXCFImage() 函式存在一個 NULL 指標解除參照缺陷，這是因為不當處理 XCF 檔案所致。未經驗證的遠端攻擊者可加以惡意利用，誘騙使用者開啟特製 XCF 檔案，造成拒絕服務情形。(CVE-2017-6501)

远程 Windows 主机上安装的 ImageMagick 版本是低于 6.9.7-8 的 6.x 或低于 7.0.4-8 的 7.x。因而会受到多个拒绝服务漏洞的影响：- coders/psd.c 中的 ReadPSDChannel() 函数存在一个空指针取消引用缺陷，这是因为不当处理 PSD 文件所致。未经身份验证的远程攻击者可利用此问题，通过诱使用户打开特制 PSD 文件，从而造成拒绝服务情形。(CVE-2017-6497) - 由于未正确处理嵌套异常，Magick++/lib/Exception.cpp 中存在缺陷。未经身份验证的远程攻击者可利用此问题，造成应用程序消耗过度资源，从而导致拒绝服务情形。(CVE-2017-6499) - 由于未正确处理 XCF 文件，coders/xcf.c 内的 ReadXCFImage() 函数中存在空指针取消引用缺陷。未经身份验证的远程攻击者可利用此问题，通过诱使用户打开特制 XCF 文件，从而造成拒绝服务情形。(CVE-2017-6501)

The version of ImageMagick installed on the remote Windows host is 6.x prior to 6.9.7-8 or 7.x prior to 7.0.4-8. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A NULL pointer dereference flaw exists in the     ReadPSDChannel() function in coders/psd.c due to     improper handling of PSD files. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted PSD file, to cause a denial     of service condition. (CVE-2017-6497)

  - A flaw exists in Magick++/lib/Exception.cpp due to     improper handling of nested exceptions. An     unauthenticated, remote attacker can exploit this to     cause the application to consume excessive resources,     resulting in a denial of service condition.
    (CVE-2017-6499)

  - A NULL pointer dereference flaw exists in the     ReadXCFImage() function in coders/xcf.c due to improper     handling of XCF files. An unauthenticated, remote     attacker can exploit this, by convincing a user to open     a specially crafted XCF file, to cause a denial of     service condition. (CVE-2017-6501)

Please reference CVE/URL list for details

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: NULL pointer dereference in  GetMagickProperty function in MagickCore/property.c     (CVE-2018-16329)

  - The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper     variable type for the allocation size, which might allow remote attackers to cause a denial of service     (crash) via a crafted PNG file that triggers incorrect memory allocation. (CVE-2012-3437)

  - Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier     allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a     large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than     CVE-2014-2030. (CVE-2014-1947)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: Insufficient shell characters filtering (CVE-2016-3714)

  - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328)

  - The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper     variable type for the allocation size, which might allow remote attackers to cause a denial of service     (crash) via a crafted PNG file that triggers incorrect memory allocation. (CVE-2012-3437)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: NULL pointer dereference in  GetMagickProperty function in MagickCore/property.c     (CVE-2018-16329)

  - The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted image file. (CVE-2014-8354)

  - PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-     of-bounds read). (CVE-2014-8355)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
135519	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-1390)	Nessus	Huawei Local Security Checks	2020/4/15	2021/2/9	critical
97892	ImageMagick 6.x < 6.9.7-8/7.x < 7.0.4-8の複数のDoS	Nessus	Windows	2017/3/22	2024/6/4	high
100441	FreeBSD：ImageMagick -- 複数の脆弱性（50776801-4183-11e7-b291-b499baebfeaf）	Nessus	FreeBSD Local Security Checks	2017/5/26	2021/1/4	critical
97892	ImageMagick 6.x < 6.9.7-8 / 7.x < 7.0.4-8 多個 DoS	Nessus	Windows	2017/3/22	2024/6/4	high
97892	ImageMagick 6.x < 6.9.7-8 / 7.x < 7.0.4-8 多种 DoS	Nessus	Windows	2017/3/22	2024/6/4	high
97892	ImageMagick 6.x < 6.9.7-8 / 7.x < 7.0.4-8 Multiple DoS	Nessus	Windows	2017/3/22	2024/6/4	high
100441	FreeBSD : ImageMagick -- multiple vulnerabilities (50776801-4183-11e7-b291-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	2017/5/26	2021/1/4	critical
199269	RHEL 6 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
131846	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-2354)	Nessus	Huawei Local Security Checks	2019/12/10	2021/2/9	critical
199277	RHEL 5 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/9/10	critical
199283	RHEL 7 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/8/2	critical

検出

プラグインの検索

critical

high

critical

high

high

high

critical

critical

critical

critical

critical