CVE-2016-8866

The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.

References

Affected packages

Git / github.com/imagemagick/imagemagick6

Affected ranges

Type

GIT

Repo

https://github.com/imagemagick/imagemagick6

Events

Introduced

Fixed

b91dd14ef55884af8f28e8978dac201a76b23d63

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.9.6-6"
        }
    ]
}

Affected versions

6.*

6.9.4-0

6.9.4-1

6.9.4-10

6.9.4-2

6.9.4-3

6.9.4-4

6.9.4-5

6.9.4-6

6.9.4-7

6.9.4-8

6.9.4-9

6.9.5-0

6.9.5-1

6.9.5-10

6.9.5-2

6.9.5-3

6.9.5-4

6.9.5-5

6.9.5-6

6.9.5-7

6.9.5-8

6.9.5-9

6.9.6-0

6.9.6-1

6.9.6-2

6.9.6-3

6.9.6-4

6.9.6-5

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "7.0.0-0"
            },
            {
                "last_affected": "7.0.3-7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "42.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "42.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.2"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8866.json"