Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Magick.NET-Q16-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-OpenMP-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-OpenMP-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-arm64 | nuget | < 14.15.0 | 14.15.0 |
Miggo AIRoot Cause AnalysisThe security advisory pointed to a heap buffer overflow in the X11 import functionality of ImageMagick when handling a crafted window title. By analyzing the commits between the last known vulnerable version and the first patched version, I identified the exact commit that fixes the vulnerability. The patch is located in the XImportImage function within the MagickCore/xwindow.c file. The vulnerable code used CopyMagickString to copy the X11 window title (window_name.value) into the image->filename buffer. The size of the copy was determined by the length of the window title (window_name.nitems+1), without considering the size of the destination buffer. This allowed a malicious actor to provide a long window title, causing a buffer overflow. The fix introduces a call to MagickMin to ensure that the amount of data copied does not exceed the allocated buffer size, MagickPathExtent. Therefore, the XImportImage function is the vulnerable function that would appear in a runtime profile during exploitation.
XImportImageMagickCore/xwindow.c