A flaw was found in ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file. References: https://github.com/ImageMagick/ImageMagick/issues/1336 Upstream Patches: https://github.com/ImageMagick/ImageMagick6/commit/a5db4873626f702d2ddd8bc293573493e0a412c0 https://github.com/ImageMagick/ImageMagick/commit/5d71e23b853461dd3628cd1218834fcf13938365
Created ImageMagick tracking bugs for this issue: Affects: fedora-all [bug 1637187]
Statement: This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.
openshift-enterprise-3: notaffected as RHEL-7 is notaffected. Removed openshift-enterprise-3 from whiteboard.