CVE-2018-18024

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ImageMagick/ImageMagick/issues/1337Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
https://usn.ubuntu.com/4034-1/
https://github.com/ImageMagick/ImageMagick/issues/1337Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
https://usn.ubuntu.com/4034-1/

Timeline

Published: Oct 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-180256.5In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to CVE-2018-180267.8IMFCameraProtect.sys in IObit Malware Fighter 6.2 (and possibly lower versions) is vulnerable to a stack-based buffer overflow. The attacker CVE-2018-180295.4Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.CVE-2018-18036.1IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking a CVE-2018-180356.1A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site s CVE-2018-18043.7IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tok CVE-2018-18054.3IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive inf CVE-2018-180564.6An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implem CVE-2018-180585.3An issue was discovered in Bitdefender Engines before 7.76662. A vulnerability has been discovered in the iso.xmd parser that results from a CVE-2018-180595.3An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a CVE-2018-180605.3An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results fro CVE-2018-180617.5An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides