ImageMagick: Possible memory leak in ASHLAR encoder

Vulnerability

Overview

A memory leak exists in ImageMagick's ASHLAR image writer, affecting versions prior to 7. The flaw allows an attacker to exhaust process memory by providing a crafted image that causes small objects to be allocated but never freed. This is described as a memory leak in the ASHLAR encoder [1][4].

Exploitation

To exploit this, an attacker must supply a specially crafted image to the ASHLAR writer. The vulnerability does not require authentication, as it can be triggered through normal image processing operations. The leak occurs when processing such images, leading to repeated allocations without corresponding deallocations, eventually exhausting available memory [2][3].

Impact

If exploited, the memory leak can cause a denial of service by consuming all available system memory. This could lead to process crashes or system instability. The impact is limited to availability, as the leak does not allow code execution or data exfiltration [1][4].

Mitigation

The vulnerability is fixed in ImageMagick version 7.1.2-15. Users should upgrade to this version or later. No workaround is currently documented. The fix addresses the allocation-free issue in the ASHLAR writer [1][3].