CVE-2014-2030: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2014-2030 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 11.05% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 06-02-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
11.05%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- ubuntu_linuxEOL12.04 | 12.10 | 13.10
Debian1 product
- imagemagick< 8:6.7.7.10+dfsg-1
Imagemagick1 product
- imagemagick6.8.8-5
Opensuse1 product
- opensuseEOL11.4 | 12.3 | 13.1
4 vendors · 4 products
References
9 links- www.openwall.com/lists/oss-security/2014/02/12/2X Refsource MISCMailing ListPatchThird Party Advisory
- lists.opensuse.org/opensuse-updates/2014-03/msg00032.htmlX Refsource CONFIRMMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2014-03/msg00039.htmlX Refsource CONFIRMMailing ListThird Party Advisory
- web.archive.org/web/20090120112751/http://trac.imagemagick.org/changeset/13736X Refsource CONFIRMPatchThird Party Advisory
