CVE-2016-7524: 
ImageMagick vulnerability analysis and mitigation

CVE-2016-7524 is a security vulnerability discovered in ImageMagick's coders/meta.c component. The vulnerability was reported on January 24, 2016, and allows remote attackers to cause a denial of service through an out-of-bounds read via a crafted file (Ubuntu Security, CVE Mitre).

The vulnerability specifically manifests as a heap-buffer-overflow in the parse8BIM function at line 465 of coders/meta.c. When processing certain crafted files, the code performs an out-of-bounds read operation, which can lead to a denial of service condition. The issue was discovered through fuzzing with AFL-fuzz and was confirmed using AddressSanitizer (Launchpad Bug).

The primary impact of this vulnerability is the potential for denial of service attacks against systems running affected versions of ImageMagick. When exploited, the vulnerability can cause the application to crash through an out-of-bounds read operation (CVE Mitre).

The vulnerability was fixed in multiple versions of ImageMagick through commits f8c318d and 97c9f43, which modified the length checking in the parse8BIM function. Ubuntu has released fixes for various versions: 16.10 (yakkety), 16.04 LTS (xenial), 14.04 LTS (trusty), and 12.04 LTS (precise) (Ubuntu Security, GitHub Commit).