CVE-2007-4988

Publication date 24 September 2007

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
graphicsmagick	8.10 intrepid	Fixed 1.1.11-1
	8.04 LTS hardy	Fixed 1.1.11-1
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Not in release
imagemagick	8.10 intrepid	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	8.04 LTS hardy	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	7.10 gutsy	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	7.04 feisty	Fixed 7:6.2.4.5.dfsg1-0.14ubuntu0.2
	6.10 edgy	Fixed 7:6.2.4.5.dfsg1-0.10ubuntu0.4
	6.06 LTS dapper	Fixed 6:6.2.4.5-0.6ubuntu0.7

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2007-4988

Cvss 3 Severity Score

Status

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references