CVE-2016-8862

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick before 7.0.3.3 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3726Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/20/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/20/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/93794Third Party Advisory, VDB Entry
https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1387135Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/271Patch, Third Party Advisory, VDB Entry
http://www.debian.org/security/2016/dsa-3726Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/20/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/20/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/93794Third Party Advisory, VDB Entry
https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1387135Issue Tracking, Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/271Patch, Third Party Advisory, VDB Entry

Timeline

Published: Feb 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-88639.8Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows rem CVE-2016-88647.5named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of ser CVE-2016-88668.8The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified im CVE-2016-88677.5Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permi CVE-2016-88699.8The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote CVE-2016-88708.1The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registr CVE-2016-88716.2In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient q CVE-2016-88755.3The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to cau CVE-2016-88767.5Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attacke CVE-2016-88778.8Heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to exe CVE-2016-88788.8Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attacke CVE-2016-88796.5The thumbnail shell extension plugin (FoxitThumbnailHndlr_x86.dll) in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attack