The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file. Reference: https://github.com/ImageMagick/ImageMagick/issues/471
Created ImageMagick tracking bugs for this issue: Affects: epel-8 [bug 1772645] Affects: fedora-all [bug 1772644]
Analysis: This is essentially memory leak, resulting in memory exhaustion and maybe crash. Upstream commit: https://github.com/ImageMagick/ImageMagick/commit/5964475e21e7e3bdd27835b71aa17d1678c21d7c
This is an issue from 2017. Please read that again - the year 2017. This issue is 2 years old. Why was this issue opened? Fedora ships up to date copies of ImageMagick 6, which means this CVE is fixed. Please fix your scripts that create these bugs. This is not the first very old bug to be opened. I am no longer going to reply as they are spam to my inbox.
ImageMagick 7 commit: https://github.com/ImageMagick/ImageMagick/commit/31b842a218225cd7feddf65cbccf9d783c6cb526 ImageMagick 6 commit: https://github.com/ImageMagick/ImageMagick6/commit/5964475e21e7e3bdd27835b71aa17d1678c21d7c
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1180 https://access.redhat.com/errata/RHSA-2020:1180
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2017-11166