PT-2019-2863 · Imagemagick+1 · Imagemagick+1
Suhwansong
·
Publicado
2019-06-21
·
Atualizado
2023-03-02
·
CVE-2019-13298
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ImageMagick version 7.0.8-50 Q16
Description
The issue is related to a heap-based buffer overflow in the SetPixelViaPixelInfo function due to an error in MagickCore/enhance.c. This can be exploited by a remote attacker using a specially crafted image, potentially leading to a denial of service or the execution of arbitrary code. The vulnerability is associated with a buffer overflow in dynamic memory.
Recommendations
For ImageMagick version 7.0.8-50 Q16, consider disabling the SetPixelViaPixelInfo function as a temporary workaround until a patch is available. Restrict access to the pixel-accessor.h module to minimize the risk of exploitation. Avoid using the affected function with untrusted image inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Out of bounds Read
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Imagemagick
Suse