CVE-2016-5240

Published: Feb 27, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.

Affected (1)

Products: Graphicsmagick: Graphicsmagick

Graphicsmagick

1 product

Graphicsmagick

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Graphicsmagick Graphicsmagick	Up to 1.3.23

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=ddc999ec896c

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3746

Source: cve@mitre.org

http://www.graphicsmagick.org/ChangeLog-2016.html

Source: cve@mitre.org

Release NotesVendor Advisory

http://www.openwall.com/lists/oss-security/2016/05/01/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/01/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/02/14

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/89348

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2016:1237

Source: cve@mitre.org

http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=ddc999ec896c