Imagemagick: heap-buffer-overflow in coders/tiff.c

Vulnerability

A heap-based buffer overflow vulnerability exists in the coders/tiff.c file of ImageMagick versions up to and including 7.1.1 [1][2]. The flaw occurs when processing specially crafted TIFF images, leading to memory corruption.

Exploitation

Exploitation requires the attacker to convince a user to open a malicious TIFF file using ImageMagick or an application leveraging it. No authentication or network access is needed; the attack is local and depends on user interaction [1].

Impact

Successful exploitation results in an application crash, causing a denial of service. No code execution or data disclosure has been reported [1].

Mitigation

The fix is available in a commit [2] and is included in ImageMagick versions after 7.1.1. Users should update to the latest version. No workaround is documented.