PT-2018-3481 · Graphicsmagick+3 · Graphicsmagick+3
Augustus Wang
·
Publicado
2018-12-17
·
Atualizado
2023-03-27
·
CVE-2018-20189
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
GraphicsMagick version 1.3.31
Description:
The issue is related to the ReadDIBImage function in GraphicsMagick, which lacks proper input validation. This can be exploited by a remote attacker using a specially crafted dib file, potentially leading to a crash and denial of service. The vulnerability is triggered when a dib file appears to have direct pixel values and colormapping, which is not supported beyond 8-bits/sample, resulting in uninitialized indexes.
Recommendations:
For GraphicsMagick version 1.3.31, consider disabling the ReadDIBImage function in coders/dib.c as a temporary workaround to minimize the risk of exploitation. Restrict access to dib files to prevent potential attacks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Graphicsmagick
Linuxmint
Suse
Ubuntu