CVE-2025-62171

一、漏洞信息
 漏洞编号：[CVE-2025-62171](https://nvd.nist.gov/vuln/detail/CVE-2025-62171)
 漏洞归属组件：[ImageMagick](https://gitee.com/src-openeuler/ImageMagick)
 漏洞归属的版本：6.9.10.67,6.9.12.42,6.9.12.86,7.1.0.28,7.1.1.11,7.1.1.15,7.1.1.35,7.1.1.41,7.1.1.8
 CVSS V3.0分值：
  BaseScore：5.9 Medium
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  ImageMagick contains an integer overflow vulnerability in the BMP decoder. An attacker can exploit this vulnerability by providing a specially crafted BMP file, leading to buffer overflow or denial of service.
 漏洞公开时间：2025-10-18 01:15:49
 漏洞创建时间：2025-10-17 19:31:31
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-62171
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| ImageMagick/ImageMagick |  | https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00.patch |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. 
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(6.9.13.28):受影响
2.openEuler-22.03-LTS-SP3(7.1.2.2):受影响
3.openEuler-22.03-LTS-SP4(7.1.2.2):受影响
4.openEuler-24.03-LTS(7.1.2.2):受影响
5.openEuler-24.03-LTS-Next(7.1.2.2):受影响
6.openEuler-24.03-LTS-SP1(7.1.2.2):受影响
7.openEuler-24.03-LTS-SP2(7.1.2.2):受影响
8.master(7.1.2.5):不受影响

修复是否涉及abi变化(是/否)：
  1.master(7.1.2.5):否
2.openEuler-20.03-LTS-SP4(6.9.13.28):否
3.openEuler-22.03-LTS-SP3(7.1.2.2):否
4.openEuler-22.03-LTS-SP4(7.1.2.2):否
5.openEuler-24.03-LTS(7.1.2.2):否
6.openEuler-24.03-LTS-Next(7.1.2.2):否
7.openEuler-24.03-LTS-SP1(7.1.2.2):否
8.openEuler-24.03-LTS-SP2(7.1.2.2):否

原因说明：
  1.openEuler-20.03-LTS-SP4(6.9.13.28):正常修复
2.openEuler-22.03-LTS-SP3(7.1.2.2):正常修复
3.openEuler-22.03-LTS-SP4(7.1.2.2):正常修复
4.openEuler-24.03-LTS(7.1.2.2):正常修复
5.openEuler-24.03-LTS-Next(7.1.2.2):正常修复
6.openEuler-24.03-LTS-SP1(7.1.2.2):正常修复
7.openEuler-24.03-LTS-SP2(7.1.2.2):正常修复
8.master(7.1.2.5):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2588

src-openEuler/ImageMagick
关闭

内容风险标识

评论 (7)

src-openEuler/ImageMagick关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-62171

评论 (7)

搜索帮助

src-openEuler/ImageMagick
关闭