Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ImageMagick ImageMagick
Default version status: unaffected
7.0.0-0 to < 7.1.2-32affected7.1.2-32unaffected
ImageMagick ImageMagick
Default version status: unaffected
0 to < 6.9.13-57affected6.9.13-57unaffected
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw ↗
- https://github.com/ImageMagick/ImageMagick/commit/45bb7328b36c163234f5ccb7f1d494b7c4c8c775 ↗
- https://github.com/ImageMagick/ImageMagick6/commit/30499e67801ee8a0e70817d28b861b8616d72555 ↗
- https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-code-injection-via-cip-encoder ↗