CVE-2012-1185

Vulnerability

Multiple integer overflow vulnerabilities exist in ImageMagick versions 6.7.5 and earlier, specifically in magick/profile.c or magick/property.c. The flaw occurs when processing the ResolutionUnit tag in the EXIF IFD0 of an image. An attacker can supply a crafted offset value that causes an integer overflow when computing the sum of number_bytes and offset, leading to memory corruption. This vulnerability exists due to an incomplete fix for CVE-2012-0247 [1][3].

Exploitation

To exploit this vulnerability, an attacker must craft a malicious image file containing a specially crafted ResolutionUnit tag with an offset value that triggers the integer overflow. The attacker then needs to deliver this file to a user or automated system that processes it using ImageMagick. User interaction is required (e.g., opening the file or automated processing). No special network position is needed; the attack vector is local via file handling [1][2].

Impact

Successful exploitation can result in a denial of service (application crash) due to memory corruption. In some cases, arbitrary code execution may be possible with the privileges of the user invoking the program, leading to full compromise of the affected system [1][4].

Mitigation

Ubuntu released updated packages in USN-1435-1 on 1 May 2012 [1]. The fix was also committed to the ImageMagick subversion repository prior to the CVE disclosure [3][4]. Users should upgrade to ImageMagick version 6.7.5-7 or later. No workaround besides applying the patch is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.