{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22767?format=json","vulnerability_id":"VCID-bpc4-hekp-6ye9","summary":"ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS\nThe PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.","aliases":[{"alias":"GHSA-wgxp-q8xq-wpp9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72994?format=json","purl":"pkg:nuget/Magick.NET-Q16-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/73004?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/73006?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/72993?format=json","purl":"pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-HDRI-OpenMP-x64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/72996?format=json","purl":"pkg:nuget/Magick.NET-Q16-OpenMP-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-OpenMP-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/73002?format=json","purl":"pkg:nuget/Magick.NET-Q16-OpenMP-x64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-OpenMP-x64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/73007?format=json","purl":"pkg:nuget/Magick.NET-Q16-OpenMP-x86@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q16-OpenMP-x86@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/72999?format=json","purl":"pkg:nuget/Magick.NET-Q8-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/73012?format=json","purl":"pkg:nuget/Magick.NET-Q8-OpenMP-arm64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-OpenMP-arm64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/72995?format=json","purl":"pkg:nuget/magick.net-q8-openmp-x64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/magick.net-q8-openmp-x64@14.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/84295?format=json","purl":"pkg:nuget/Magick.NET-Q8-OpenMP-x64@14.10.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Magick.NET-Q8-OpenMP-x64@14.10.3"}],"affected_packages":[],"references":[{"reference_url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3"},{"reference_url":"https://github.com/ImageMagick/ImageMagick","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/commit/436e5d2589e3c0adc10d9aa189e81d5d088d8207"},{"reference_url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"GHSA-wgxp-q8xq-wpp9","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9"},{"reference_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9","reference_id":"GHSA-wgxp-q8xq-wpp9","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wgxp-q8xq-wpp9"}],"weaknesses":[{"cwe_id":125,"name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"0.1 - 3.7","exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bpc4-hekp-6ye9"}