A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: NULL pointer dereference in  GetMagickProperty function in MagickCore/property.c     (CVE-2018-16329)

  - The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted image file. (CVE-2014-8354)

  - PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-     of-bounds read). (CVE-2014-8355)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2253 advisory.

    A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage()     in coders/svg.c. This issue is due to not checking the return value from libxml2's     xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
    (CVE-2021-3596)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage()     in coders/svg.c. This issue is due to not checking the return value from libxml2's     xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
    (CVE-2021-3596)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3007 advisory.

    CVE-2021-3596 A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in     ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's     xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
    CVE-2022-28463 ImageMagick is vulnerable to Buffer Overflow. For Debian 9 stretch, these problems have     been fixed in version 8:6.9.7.4+dfsg-11+deb9u14. We recommend that you upgrade your imagemagick packages.
    For the detailed security status of imagemagick please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199283	RHEL 7 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
181712	Amazon Linux 2 : ImageMagick (ALAS-2023-2253)	Nessus	Amazon Linux Local Security Checks	medium
164189	EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2022-2223)	Nessus	Huawei Local Security Checks	medium
161205	Debian DLA-3007-1 : imagemagick - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-3596

medium

Tenable Plugins

critical

medium

medium

high