PT-2019-2861 · Imagemagick+4 · Imagemagick+4

Suhwansong

·

Publicado

2019-07-05

·

Atualizado

2024-10-03

·

CVE-2019-13297

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-50 Q16
Description The issue is related to a heap-based buffer over-read in the AdaptiveThresholdImage function at MagickCore/threshold.c. This occurs because a height of zero is mishandled. Exploitation of this issue may allow a remote attacker to cause a denial of service or disclose sensitive information using a specially crafted image.
Recommendations For ImageMagick version 7.0.8-50 Q16, as a temporary workaround, consider disabling the AdaptiveThresholdImage function until a patch is available. Restrict access to the threshold.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2019-02829
CESA-2020_1180
CVE-2019-13297
DLA-1888-1
DLA-2333-1
DSA-4712-1
OPENSUSE-SU-2019:1983-1
OPENSUSE-SU-2019_1983-1
RHSA-2020:1180
RHSA-2020_1180
SUSE-SU-2019:2010-1
SUSE-SU-2019:2106-1
USN-4192-1
USN-7053-1

Produtos afetados

Centos
Imagemagick
Red Hat
Suse
Ubuntu