Candidate: CVE-2016-9773
PublicDate: 2017-02-17 02:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9773
 https://blogs.gentoo.org/ago/2016/12/01/imagemagick-heap-based-buffer-overflow-in-ispixelgray-pixel-accessor-h-incomplete-fix-for-cve-2016-9556/
Description:
 Heap-based buffer overflow in the IsPixelGray function in
 MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers
 to cause a denial of service (out-of-bounds heap read) via a crafted image
 file.  NOTE: this vulnerability exists because of an incomplete fix for
 CVE-2016-9556.
Ubuntu-Description:
Notes:
 mdeslaur> only affects ImageMagick-7 branch, see
 mdeslaur> https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31045
Bugs:
 https://github.com/ImageMagick/ImageMagick/issues/312
Priority: medium
Discovered-by: Agostino Sarubbo
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [5.5 MEDIUM]

Patches_imagemagick:
 upstream: https://github.com/ImageMagick/ImageMagick/commit/4e8c2ed53fcb54a34b3a6185b2584f26cf6874a3
upstream_imagemagick: needed
precise_imagemagick: not-affected (code not present)
trusty_imagemagick: not-affected (code not present)
trusty/esm_imagemagick: DNE (trusty was not-affected [code not present])
vivid/stable-phone-overlay_imagemagick: DNE
vivid/ubuntu-core_imagemagick: DNE
xenial_imagemagick: not-affected (code not present)
esm-infra/xenial_imagemagick: not-affected (code not present)
yakkety_imagemagick: not-affected (code not present)
devel_imagemagick: not-affected (code not present)