Denial of Service in ImageMagick SVG Parsing Before

Executive Summary

This vulnerability in ImageMagick occurs when the software reads a malicious SVG file, which can cause a Denial of Service (DoS) attack. It affects versions prior to 7.1.2-12, and the issue is fixed in version 7.1.2-12.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a Denial of Service (DoS) attack, potentially making the ImageMagick service unavailable or unresponsive when processing malicious SVG files.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-12 or later to fix the denial of service vulnerability caused by processing malicious SVG files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial-of-service (DoS) by crashing the ImageMagick application when processing malicious SVG files, but it does not impact confidentiality or integrity of data. Therefore, it does not directly affect compliance with standards like GDPR or HIPAA, which focus on data protection and privacy. However, availability is impacted, which could indirectly affect compliance if the service relying on ImageMagick is critical for regulatory requirements. No explicit information on compliance impact is provided. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the ImageMagick installation with a specially crafted malicious SVG file that triggers excessive recursion and causes a denial-of-service (DoS) crash. Using the Magick command-line tool to read such a crafted SVG file can reveal if the system is vulnerable, as it will crash or exhibit stack overflow behavior. For example, you can run a command like `magick identify malicious.svg` or `magick convert malicious.svg output.png` where `malicious.svg` is a crafted SVG file designed to exploit the uncontrolled recursion. Monitoring for crashes or error codes such as -1073741571 (on Windows) during these operations indicates the presence of the vulnerability. Additionally, checking the installed ImageMagick version to ensure it is 7.1.2-12 or later can help confirm if the system is patched. [2]

Useful 0 Not Useful 0