FKIE_CVE-2008-1096

Vulnerability from fkie_nvd - Published: 2008-03-05 20:44 - Updated: 2026-06-16 22:50
Severity
Summary
The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
cve@mitre.orghttp://osvdb.org/43212
cve@mitre.orghttp://secunia.com/advisories/29786
cve@mitre.orghttp://secunia.com/advisories/30967
cve@mitre.orghttp://secunia.com/advisories/32945
cve@mitre.orghttp://secunia.com/advisories/36260
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1858
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2008:099
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-0145.html
cve@mitre.orghttp://www.securityfocus.com/bid/28821
cve@mitre.orghttp://www.securitytracker.com/id?1019880
cve@mitre.orghttp://www.ubuntu.com/usn/USN-681-1
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=286411Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41194
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/43212
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29786
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30967
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32945
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36260
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1858
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2008:099
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-0145.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28821
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019880
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-681-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=286411Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41194
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843
Impacted products
Vendor Product Version
imagemagick graphicsmagick 1.1.7
imagemagick graphicsmagick 1.1.8
imagemagick graphicsmagick 1.1.9
imagemagick graphicsmagick 1.1.10
imagemagick graphicsmagick 1.1.11
imagemagick graphicsmagick 1.1.12
imagemagick imagemagick 6.2.8.0
imagemagick imagemagick 6.2.8.1
imagemagick imagemagick 6.2.8.2
imagemagick imagemagick 6.2.8.3
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAB9E1C7-BCB2-43FF-8CAB-D48EFE723763",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "E32122CF-7871-479D-8C7E-BE5851C31898",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CF70195-5B78-4DA9-9EF4-2E39C03D8DEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D742E790-2ED6-4EBB-8C49-277EB1D73EC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0D10F27-B453-4550-9B63-57D2CEB8F65E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:graphicsmagick:1.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAF8A137-C144-427A-897E-5C3A3C2D5DA4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2796AA1-61E5-46E4-B28F-358A49E0B3D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C38A3C0A-0A0A-4433-82BA-AE4D3943E25C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C82A613A-1973-434E-81C5-C2A546C48A4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:imagemagick:imagemagick:6.2.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "72E2AF1B-85A6-4109-83D9-76A44E8DD6E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n load_tile en el codificador XCF de coders/xcf.c en (1) ImageMagick 6.2.8-0 y (2) GraphicsMagick (tambi\u00e9n conocido como gm) 1.1.7 permite a atacantes remotos asistidos por usuarios provocar una denegaci\u00f3n de servicio (ca\u00edda) o prosiblemente ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un archivo .xcf manipulado que dispara una escritura en el mont\u00edculo fuera de rango, posiblemente relacionada con la funci\u00f3n ScaleCharToQuantum."
    }
  ],
  "id": "CVE-2008-1096",
  "lastModified": "2026-06-16T22:50:58.940",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-03-05T20:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/43212"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29786"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/30967"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32945"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36260"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1858"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:099"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0145.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28821"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019880"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-681-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=286411"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41194"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/43212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29786"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/30967"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32945"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36260"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:099"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0145.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019880"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-681-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=286411"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41194"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10843"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.