CVE-2018-11251

Vulnerability

In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, the ReadSUNImage function in coders/sun.c contains a heap-based buffer over-read. When processing a specially crafted SUN image file, the over-read occurs in SetGrayscaleImage within MagickCore/quantize.c at line 3444, as shown in AddressSanitizer output [2]. This affects versions up to and including 7.0.7-23; the issue was later fixed in subsequent releases [1].

Exploitation

An attacker does not need authentication or elevated privileges — only the ability to provide a malicious SUN image file to a user or automated system using ImageMagick [1]. For exploitation, the attacker crafts a SUN image with invalid colormap indices, and when the image is processed (e.g., via magick buffer-overflow-SetGrayscaleImage /dev/null), the WriteSUNImage path triggers QuantizeImage, leading to the buffer over-read in SetGrayscaleImage [2].

Impact

Successful exploitation causes a denial of service — the application crashes (heap-buffer-overflow) due to an out-of-bounds read [2]. The description notes only a crash, but the Ubuntu advisory [1] indicates that code execution might also be possible, though this is not confirmed for this specific CVE. The attacker gains no additional privileges; the crash occurs with the privileges of the user running ImageMagick.

Mitigation

Ubuntu released updates for all supported releases (versions 8:6.9.7.4+dfsg-16ubuntu6.7 and later) in USN-3681-1 [1]. Users should upgrade to the fixed ImageMagick package provided by their distribution. No workaround is documented; disabling the SUN coder (e.g., via policy.xml) may prevent exposure until patching is complete.