CVE-2014-9826
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-9826
Vendor advisory: cve@mitre.org — https://bugzilla.redhat.com/show_bug.cgi?id=1343482
Vendor advisory: cve@mitre.org — https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276
Vendor advisory: cve@mitre.org — http://www.openwall.com/lists/oss-security/2014/12/24/1
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2014-9826.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 8:6.8.9.9-4 |
| debian | bullseye | fixed | 8:6.8.9.9-4 |
| debian | forky | fixed | 8:6.8.9.9-4 |
| debian | sid | fixed | 8:6.8.9.9-4 |
| debian | trixie | fixed | 8:6.8.9.9-4 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| imagemagick | imagemagick | - | |
References
- https://www.suse.com/security/cve/CVE-2014-9826.html
- http://www.openwall.com/lists/oss-security/2014/12/24/1
- http://www.openwall.com/lists/oss-security/2016/06/02/13
- https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a2985699455bb0b45e276
- https://bugzilla.redhat.com/show_bug.cgi?id=1343482
- https://security-tracker.debian.org/tracker/CVE-2014-9826
CWEs
CWE-388
Verify integrity in audit chain (admin only). AS-IS.