Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2014-9852
Critical
Low
Medium
High
Critical
9.8
CVSS Score
Vulnerability Description
distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
Known Affected Software
6 configuration(s) from 2 vendor(s)
opensuse
Version:
13.2
CPE:
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
leap
Version:
42.1
CPE:
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
linux_enterprise_server
Version:
12
CPE:
cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:*:*:*
linux_enterprise_desktop
Version:
12
CPE:
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*
linux_enterprise_workstation_extension
Version:
12
CPE:
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
linux_enterprise_software_development_kit
Version:
12
CPE:
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
This vulnerability affects 6 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.htmlcve@mitre.org Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.htmlcve@mitre.org Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.htmlcve@mitre.org Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2016/06/02/13cve@mitre.org Mailing List Patch
-
https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=37ec7d53dcb99fbd1f5c33442594d5e279630563cve@mitre.org Patch
-
https://bugzilla.redhat.com/show_bug.cgi?id=1343512cve@mitre.org Issue Tracking Patch Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2016/06/02/13af854a3a-2127-422b-91ae-364da2661108 Mailing List Patch
-
https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=37ec7d53dcb99fbd1f5c33442594d5e279630563af854a3a-2127-422b-91ae-364da2661108 Patch
-
https://bugzilla.redhat.com/show_bug.cgi?id=1343512af854a3a-2127-422b-91ae-364da2661108 Issue Tracking Patch Third Party Advisory
Severity Details
9.8
out of 10.0
Critical
Weakness Type (CWE)
CWE-913
Improper Control of Dynamically-Managed Code Resources
- Description
- The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
- Typical Severity
- Medium
- Abstraction Level
- Class
Key Information
- Published Date
- March 17, 2017
