CVE-2016-5241

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.htmlThird Party Advisory
http://www.graphicsmagick.org/NEWS.html#may-30-2016Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/05/01/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/02/14Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/89348Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1333410Issue Tracking
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00037.htmlThird Party Advisory
http://www.graphicsmagick.org/NEWS.html#may-30-2016Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/05/01/6Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/02/14Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/89348Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1333410Issue Tracking
https://lists.debian.org/debian-lts-announce/2018/06/msg00009.htmlThird Party Advisory

Timeline

Published: Feb 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52425.6The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause CVE-2016-52435.5The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string CVE-2016-52447.5The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which all CVE-2016-52477.8The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; Th CVE-2016-52485.5The StopProxy command in LSC.Services.SystemService in Lenovo Solution Center before 3.3.003 allows local users to terminate arbitrary proce CVE-2016-52497.8Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving t CVE-2016-52504.3Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the prev CVE-2016-52514.3Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL.CVE-2016-52528.8Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow CVE-2016-52534.7The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback appl CVE-2016-52549.8Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allo CVE-2016-52558.8Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to exe