Augustus Wang

Name of the Vulnerable Software and Affected Versions: GraphicsMagick version 1.3.31 Description: The issue is related to the ReadDIBImage function in GraphicsMagick, which lacks proper input validation. This can be exploited by a remote attacker using a specially crafted dib file, potentially leading to a crash and denial of service. The vulnerability is triggered when a dib file appears to have direct pixel values and colormapping, which is not supported beyond 8-bits/sample, resulting in uninitialized indexes. Recommendations: For GraphicsMagick version 1.3.31, consider disabling the ReadDIBImage function in coders/dib.c as a temporary workaround to minimize the risk of exploitation. Restrict access to dib files to prevent potential attacks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.