PT-2019-13910 · Imagemagick+4 · Imagemagick+4

Boo0M · Published 2019-05-21 · Updated 2023-03-02 · CVE-2019-14980

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions 6.x through 6.9.10-41 ImageMagick versions 7.x through 7.0.8-41

Description The issue is related to a use after free vulnerability in the UnmapBlob function. This vulnerability allows an attacker to cause a denial of service by sending a crafted file.

Recommendations For ImageMagick versions 6.x through 6.9.10-41, update to version 6.9.10-42 or later. For ImageMagick versions 7.x through 7.0.8-41, update to version 7.0.8-42 or later.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2019-1875

ALT-PU-2020-1405

CESA-2020_1180

CVE-2019-14980

OPENSUSE-SU-2019:2515-1

OPENSUSE-SU-2019:2519-1

OPENSUSE-SU-2019_2515-1

OPENSUSE-SU-2019_2519-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2019:2785-1

SUSE-SU-2019:2785-2

SUSE-SU-2019:2896-1

SUSE-SU-2019_2785-1

SUSE-SU-2019_2785-2

SUSE-SU-2019_2896-1

Affected Products

Alt Linux

Centos

Imagemagick

Red Hat

Suse

References · 42

• https://github.com/ImageMagick/ImageMagick/compare/7.0.8-41...7.0.8-42 · Patch
• https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/614a257295bdcdeda347086761062ac7658b6830 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2019:2519-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2785-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2785-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14980 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2515-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14980 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2896-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1180.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick6/issues/43 · Note
• https://bugzilla.suse.com/1146213 · Note