PT-2018-3701 · Imagemagick+5 · Imagemagick+5

Riccardo Schirone · Publicado 2018-03-15 · Atualizado 2024-09-04 · CVE-2019-10131

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.7-28

Description The issue is related to an off-by-one read vulnerability in the formatIPTCfromBuffer function in coders/meta.c. This vulnerability allows an attacker to read beyond the end of the buffer or crash the program, potentially leading to unauthorized access to confidential data and denial of service.

Recommendations For versions prior to 7.0.7-28, update to version 7.0.7-28 or later to resolve the issue. As a temporary workaround, consider restricting access to the formatIPTCfromBuffer function in coders/meta.c to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-193

CWE-119

Identificadores relacionados

ALT-PU-2018-1520

BDU:2021-03441

CESA-2020_1180

CVE-2019-10131

DLA-2333-1

OPENSUSE-SU-2019_1427-1

OPENSUSE-SU-2019_1683-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2019:1712-1

USN-4034-1

USN-6985-1

Produtos afetados

Alt Linux

Centos

Imagemagick

Red Hat

Suse

Ubuntu

Referências · 85

• https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551b94a794864861592e · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10131 · Aviso do Fabricante
• https://bugzilla.suse.com/1135236 · Nota
• https://usn.ubuntu.com/4034-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14434 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12979 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-11472 · Nota
• https://ubuntu.com/security/CVE-2017-12806 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-11598 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-20467 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-18023 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-11598 · Nota
• https://bugzilla.suse.com/1136732 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10131 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00051.html · Aviso do Fabricante