CVE-2016-7513

Vulnerability

An off-by-one error exists in the CopyPixels function within magick/cache.c in ImageMagick. This flaw occurs when cloning pixel cache data, where the size calculation for memory operations is off by one, potentially causing an out-of-bounds read or write. The vulnerability affects ImageMagick versions prior to the commit that removed the CopyPixels function and replaced it with a corrected memcpy call [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted image file to ImageMagick. No authentication or special privileges are required; the attack can be performed remotely if the application processes untrusted images. The exact trigger is unspecified, but the off-by-one error leads to a segmentation fault when the pixel cache is cloned [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a segmentation fault. The application crashes, potentially disrupting services that rely on ImageMagick for image processing. There is no indication of code execution or information disclosure [1].

Mitigation

The fix is implemented in commit a54fe0e8600eaf3dc6fe717d3c0398001507f723 [2]. Users should update ImageMagick to a version that includes this commit. Red Hat Enterprise Linux 5, 6, and 7 are not affected by this issue [3]. No workarounds have been published.