CVE-2007-4988

Publication date 24 September 2007

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
graphicsmagick	8.10 intrepid	Fixed 1.1.11-1
	8.04 LTS hardy	Fixed 1.1.11-1
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Not in release
imagemagick	8.10 intrepid	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	8.04 LTS hardy	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	7.10 gutsy	Fixed 7:6.2.4.5.dfsg1-2ubuntu1
	7.04 feisty	Fixed 7:6.2.4.5.dfsg1-0.14ubuntu0.2
	6.10 edgy	Fixed 7:6.2.4.5.dfsg1-0.10ubuntu0.4
	6.06 LTS dapper	Fixed 6:6.2.4.5-0.6ubuntu0.7

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2007-4988

Cvss 3 Severity Score

Description

Status

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references