PT-2019-5204 · Graphicsmagick+4 · Graphicsmagick+4

Galycannon · Published 2019-04-08 · Updated 2023-03-27 · CVE-2019-11006

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions 1.4 snapshot-20190322 Q8

Description The issue is related to a heap-based buffer over-read in the ReadMIFFImage function, which can be exploited by remote attackers to cause a denial of service or disclose information via an RLE packet. This can potentially allow unauthorized access to information and disrupt its integrity and availability.

Recommendations For GraphicsMagick version 1.4 snapshot-20190322 Q8, consider disabling the ReadMIFFImage function as a temporary workaround until a patch is available. Restrict access to the coders/miff.c module to minimize the risk of exploitation. Avoid using RLE packets in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

ALT-PU-2020-2894

ALT-PU-2021-1452

BDU:2020-01905

CVE-2019-11006

DLA-1755-1

DSA-4640-1

MGASA-2019-0187

OPENSUSE-SU-2019:1272-1

OPENSUSE-SU-2019:1295-1

OPENSUSE-SU-2019_1272-1

USN-4207-1

USN-5974-1

Affected Products

Alt Linux

Graphicsmagick

Linuxmint

Suse

Ubuntu

References · 60

• 🔥 https://sourceforge.net/p/graphicsmagick/bugs/598 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11006 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12672 · Vendor Advisory
• https://usn.ubuntu.com/4207-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11006 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11474 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0187 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11005 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5974-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11505 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1295-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0187.html · Security Note