Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-kwru-mwnh-9yac |
|---|
| Summary | ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML
A memory leak vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function in `MagickCore/opencl.c`. When parsing a malformed OpenCL device profile XML file that contains `<device` elements without proper `/>` closing tags, the function fails to release allocated memory for string members (`platform_name`, `vendor_name`, `name`, `version`), leading to memory leaks that could result in resource exhaustion.
**Affected Version**: ImageMagick 7.1.2-12 and possibly earlier versions
--- |
|---|
| Aliases |
| 0 |
| alias |
GHSA-qp59-x883-77qv |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
763 |
| name |
Release of Invalid Pointer or Reference |
| description |
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly. |
|
| 1 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 2 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 4.0 - 6.9 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-kwru-mwnh-9yac |
|---|