Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-r3w4-3nkn-3uh7 |
| Summary | Duplicate Advisory: ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j96m-mjp6-99xr. This link is maintained to preserve external references.
### Original Description
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. |
| Aliases |
| 0 |
| alias |
GHSA-gv85-xg33-553c |
|
|
| Fixed_packages |
|
| Affected_packages |
|
| References |
|
| Weaknesses |
| 0 |
| cwe_id |
20 |
| name |
Improper Input Validation |
| description |
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
|
| 1 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 2 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
| Exploits |
|
| Severity_range_score | 4.0 - 6.9 |
| Exploitability | 0.5 |
| Weighted_severity | 6.2 |
| Risk_score | 3.1 |
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-r3w4-3nkn-3uh7 |