CVE-2018-16329 - ImageMagick: NULL pointer dereference in GetMagickProperty function in MagickCore/property.c

CRITICAL

ImageMagick: NULL pointer dereference in GetMagickProperty function in MagickCore/property.c

Published Sep 1, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 2.28%

In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	ImageMagick	Not affected	n/a
Red Hat Enterprise Linux 6	ImageMagick	Will not fix	n/a
Red Hat Enterprise Linux 7	ImageMagick	Fix deferred	n/a

Red Hat statement

This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-16329		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1624957		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-8179		Advisory
https://github.com/ImageMagick/ImageMagick/issues/1225		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-16329
https://www.cve.org/CVERecord?id=CVE-2018-16329