PublicDateAtUSN: 2016-12-23
Candidate: CVE-2016-8707
PublicDate: 2016-12-23 22:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8707
 http://www.talosintelligence.com/reports/TALOS-2016-0216/
 https://ubuntu.com/security/notices/USN-3222-1
Description:
 An exploitable out of bounds write exists in the handling of compressed
 TIFF images in ImageMagicks's convert utility. A crafted TIFF document can
 lead to an out of bounds write which in particular circumstances could be
 leveraged into remote code execution. The vulnerability can be triggered
 through any user controlled TIFF that is handled by this functionality.
Ubuntu-Description:
Notes:
 mdeslaur> This is 0175-Fix-possible-buffer-overflow-when-writing-compressed.patch
 mdeslaur> and 0176-Fix-possible-buffer-overflow-when-writing-compressed.patch
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848139
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H [7.0 HIGH]

Patches_imagemagick:
upstream_imagemagick: released (8:6.9.7.0+dfsg-1)
precise_imagemagick: released (8:6.6.9.7-5ubuntu3.8)
trusty_imagemagick: released (8:6.7.7.10-6ubuntu3.5)
trusty/esm_imagemagick: DNE (trusty was released [8:6.7.7.10-6ubuntu3.5])
vivid/stable-phone-overlay_imagemagick: DNE
vivid/ubuntu-core_imagemagick: DNE
xenial_imagemagick: released (8:6.8.9.9-7ubuntu5.5)
esm-infra/xenial_imagemagick: released (8:6.8.9.9-7ubuntu5.5)
yakkety_imagemagick: released (8:6.8.9.9-7ubuntu8.4)
devel_imagemagick: released (8:6.9.7.4+dfsg-2ubuntu3)