PT-2019-2866 · Imagemagick+4 · Imagemagick+4

Suhwansong

·

Publicado

2019-07-05

·

Atualizado

2024-10-03

·

CVE-2019-13295

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.0.8-50
Description The issue is related to a heap-based buffer over-read in the AdaptiveThresholdImage function, located in MagickCore/threshold.c. This occurs due to improper handling of a zero-width value. Exploitation of this issue could allow a remote attacker to cause a denial of service or disclose sensitive information by using a specially crafted image.
Recommendations For ImageMagick version 7.0.8-50, consider disabling the AdaptiveThresholdImage function as a temporary workaround until a patch is available. Restrict access to the threshold.c module in MagickCore to minimize the risk of exploitation. Avoid using the AdaptiveThresholdImage function until the issue is resolved.

Exploit

Correção

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2019-02834
CESA-2020_1180
CVE-2019-13295
DLA-1888-1
DLA-2333-1
DSA-4712-1
OPENSUSE-SU-2019:1983-1
OPENSUSE-SU-2019_1983-1
RHSA-2020:1180
RHSA-2020_1180
SUSE-SU-2019:2010-1
SUSE-SU-2019:2106-1
USN-4192-1
USN-7053-1

Produtos afetados

Centos
Imagemagick
Red Hat
Suse
Ubuntu