Missing Release of Resource after Effective Lifetime Affecting imagemagick6 package, versions <6.9.10.37-r0
Threat Intelligence
EPSS
0.22% (45th percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ALPINE311-IMAGEMAGICK6-546042
- published3 Oct 2018
- disclosed3 Oct 2018
Introduced: 3 Oct 2018
CVE-2018-17965 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade Alpine:3.11 imagemagick6 to version 6.9.10.37-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream imagemagick6 package and not the imagemagick6 package as distributed by Alpine.
See How to fix? for Alpine:3.11 relevant fixed versions and status.
ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c.
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17965
- https://security-tracker.debian.org/tracker/CVE-2018-17965
- https://github.com/ImageMagick/ImageMagick/issues/1052
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-17965
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-17965
- https://usn.ubuntu.com/4034-1/