Memory Leak in ImageMagick PNG Encoder

Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-19 and involves a memory leak in the PNG encoder when writing MNG images.

Attackers can exploit this flaw by triggering the encoder failure condition, which causes the program to consume excessive memory resources.

This can lead to a denial of service as the system's memory is exhausted.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects ImageMagick versions prior to 7.1.2-19 and 6.9.13-44 when the PNG encoder attempts to write MNG images, leading to a memory leak and potential denial of service.

To detect if your system is vulnerable, first check the installed ImageMagick version using the command:

• magick --version

If the version is older than 7.1.2-19 or 6.9.13-44, your system may be vulnerable.

To test for the vulnerability, you can attempt to process a crafted MNG image that triggers the PNG encoder failure condition, but no specific detection commands or signatures are provided in the available resources.

Monitoring for unusual memory usage or crashes in ImageMagick processes when handling MNG images may also help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service condition.

By exploiting the memory leak in the PNG encoder, an attacker can cause the affected system to run out of memory, potentially crashing or becoming unresponsive.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this memory leak vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to version 7.1.2-19 or later (or 6.9.13-44 or later for the 6.x branch), as these versions contain the fix for the memory leak in the PNG encoder when writing MNG images.

Useful 0 Not Useful 0