Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-48 or later, or version 7.1.2-23 or later, where the distributed pixel cache has been changed to include a challenge–response authentication model.

Useful 0 Not Useful 0

Executive Summary

This vulnerability relates to ImageMagick, a free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache component of ImageMagick was designed to operate without a challenge–response authentication model. This means that the pixel cache did not verify the authenticity of requests, potentially allowing unauthorized access or manipulation.

Useful 0 Not Useful 0

Impact Analysis

Because the distributed pixel cache lacked a challenge–response authentication model before the specified versions, an attacker with local access and high privileges could potentially exploit this to access or manipulate cached pixel data. The CVSS score indicates a low to medium severity impact with high complexity and privileges required, and the impact is primarily on confidentiality (C:H), with no impact on integrity or availability.

Useful 0 Not Useful 0