CVE-2018-5358 : Security Advisory and Response

ImageMagick version 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.

Understanding CVE-2018-5358

There are memory leaks present in the EncodeImageAttributes function in coders/json.c of ImageMagick version 7.0.7-22 Q16.

What is CVE-2018-5358?

CVE-2018-5358 is a vulnerability in ImageMagick version 7.0.7-22 Q16 that allows memory leaks in the EncodeImageAttributes function.

The Impact of CVE-2018-5358

This vulnerability can be exploited to cause a denial of service or potentially execute arbitrary code by an attacker.

Technical Details of CVE-2018-5358

ImageMagick version 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c.

Vulnerability Description

The vulnerability allows attackers to exploit memory leaks in the EncodeImageAttributes function.

Affected Systems and Versions

Product: ImageMagick
Vendor: N/A
Version: 7.0.7-22 Q16

Exploitation Mechanism

The vulnerability can be exploited through the ReadPSDLayersInternal function in coders/psd.c.

Mitigation and Prevention

Immediate Steps to Take:

Update ImageMagick to a patched version.
Monitor for any unusual activity on the system.

Long-Term Security Practices

Regularly update software to the latest versions.
Implement proper input validation to prevent exploitation of vulnerabilities.
Conduct regular security audits and assessments.

Patching and Updates

Ensure that ImageMagick is regularly updated to the latest version to mitigate the memory leak vulnerability.