CVE-2018-16328

In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c

published September 1, 2018

CVSS
—
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

⚠️ A NULL pointer dereference in ImageMagick could leave you in a bit of a bind! This sneaky little bug lurks in the CheckEventLogging function, waiting to trip things up! 🛠️ Think of it like a restaurant kitchen that gets a delivery of ingredients but has no one around to check the order. If the chef tries to cook without confirming what’s in stock, chaos can ensue! This vulnerability could cause the application to crash unexpectedly when logging events, potentially leading to Denial of Service (DoS) conditions. While it may not be catastrophic, having your image processing tool take a nap can definitely throw a wrench in your workflow!

Put simply

Think of it like a restaurant kitchen that gets a delivery of ingredients but has no one around to check the order. If the chef tries to cook without confirming what’s in stock, chaos can ensue! In ImageMagick versions prior to 7.0.8-8, a NULL pointer dereference in the CheckEventLogging function allows for potential crashes while handling event logs.

What to do

This vulnerability could cause the application to crash unexpectedly when logging events, potentially leading to Denial of Service (DoS) conditions. While it may not be catastrophic, having your image processing tool take a nap can definitely throw a wrench in your workflow! To safeguard your image processing tasks, update to ImageMagick version 7.0.8-8 or later. Regularly monitor your application for updates and apply them promptly to maintain security. 🛡️ You've got this! Fixing this bug is just a quick update away! 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02032 · 80.9th percentile
Published
2018-09-01T22:00Z
EPSS history
Timeline
  • 01 SEP 22:00Z
    In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c
    cvelistv5