ImageMagick Vulnerabilities Expose Ubuntu Systems to DoS and Code Execution
Multiple vulnerabilities in ImageMagick affect several Ubuntu LTS versions, potentially allowing denial of service or arbitrary code execution.
TL;DR
- Stack overflow vulnerability in MVG file handling can lead to DoS.
- Use-after-free flaw in MSL coder may allow code execution.
- Integer overflow in VIFF encoder affects 32-bit systems.
- Image sampling issue may cause out-of-bounds reads.
- Affects Ubuntu 14.04 through 24.04 LTS releases.
Ubuntu has released security updates addressing multiple vulnerabilities in ImageMagick that could be exploited to cause denial of service or execute arbitrary code. These issues affect a wide range of Ubuntu Long Term Support releases, making prompt patching essential for system administrators.
The vulnerabilities stem from improper handling of various image formats and scripting features within ImageMagick. Attackers could leverage these flaws through specially crafted files, potentially crashing services or gaining unauthorized control over affected systems.
Denial of Service Risks
- Unrestricted mutual references in MVG files can trigger stack overflows.
- MSL script failures cause double-free errors leading to use-after-free conditions.
- VIFF image encoder lacks proper validation, causing integer overflows on 32-bit platforms.
- Improper column offset handling during image sampling may result in memory corruption.
Affected Platforms and Mitigation
- Impacts Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04, and 24.04 LTS versions.
- Administrators should apply USN-8558-1 patches immediately.
- Systems processing untrusted images or scripts are at highest risk.
- Review ImageMagick policy configurations to restrict dangerous operations.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.