PT-2019-2626 · Imagemagick+4 · Imagemagick+4

Hongxuchen · Published 2019-04-23 · Updated 2024-09-04 · CVE-2019-11470

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-26 Q16

Description The issue is related to the Cineon parsing component, which allows attackers to cause a denial-of-service due to uncontrolled resource consumption. This can be achieved by creating a Cineon image with an incorrect claimed image size. The problem stems from the ReadCINImage function in coders/cin.c, which lacks sufficient checks for image data in a file. An attacker can exploit this by crafting a Cineon image that exceeds the standard size, leading to a denial-of-service.

Recommendations For ImageMagick version 7.0.8-26 Q16, consider disabling the ReadCINImage function as a temporary workaround until a patch is available. Restrict access to the Cineon parsing component to minimize the risk of exploitation. Avoid using the Cineon image format until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2019-02510

CESA-2020_1180

CVE-2019-11470

DLA-1968-1

DLA-2333-1

DSA-4712-1

OPENSUSE-SU-2019:1603-1

OPENSUSE-SU-2019_1603-1

OPENSUSE-SU-2019_1683-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2019:1523-1

SUSE-SU-2019:1712-1

SUSE-SU-2019_1523-1

USN-4034-1

USN-6985-1

Affected Products

Centos

Imagemagick

Red Hat

Suse

Ubuntu

References · 94

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/1472 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/e3cdce6fe12193f235b8c0ae5efe6880a25eb957 · Patch
• https://usn.ubuntu.com/4034-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11598 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00057.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11470 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18023 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11470 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02510 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1603-1 · Vendor Advisory