CVE-2010-4167

NameCVE-2010-4167
DescriptionUntrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs601824

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)bullseye8:6.9.11.60+dfsg-1.3+deb11u4fixed
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u3fixed
bookworm8:6.9.11.60+dfsg-1.6+deb12u2fixed
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u1fixed
trixie8:6.9.13.12+dfsg1-1fixed
sid8:7.1.1.39+dfsg1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourcelenny7:6.3.7.9.dfsg2-1~lenny4
imagemagicksource(unstable)8:6.6.0.4-3low601824
Search for package or bug name: Reporting problems