PT-2019-5492 · Imagemagick+6 · Imagemagick+6

Bingchang Liu + 1 · Published 2019-01-11 · Updated 2024-10-15 · CVE-2019-7397

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.8-25 GraphicsMagick versions prior to 1.3.32

Description The issue is related to memory management errors in the WritePDFImage function of graphic editors ImageMagick and GraphicsMagick. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted image.

Recommendations For ImageMagick versions prior to 7.0.8-25, update to version 7.0.8-25 or later. For GraphicsMagick versions prior to 1.3.32, update to version 1.3.32 or later.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

CWE-399

Related Identifiers

ALT-PU-2019-1435

ALT-PU-2020-2894

ALT-PU-2021-1452

BDU:2020-03283

CESA-2020_1180

CVE-2019-7397

DSA-4712-1

MGASA-2019-0115

OPENSUSE-SU-2019:0215-1

OPENSUSE-SU-2019:0235-1

OPENSUSE-SU-2019:1141-1

OPENSUSE-SU-2019_0214-1

OPENSUSE-SU-2019_0215-1

OPENSUSE-SU-2019_1141-1

OPENSUSE-SU-2019_1320-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2019:0739-1

SUSE-SU-2019:1033-1

SUSE-SU-2019:1033-2

SUSE-SU-2019:13993-1

SUSE-SU-2019:13995-1

SUSE-SU-2019_13995-1

USN-4034-1

USN-7068-1

Affected Products

Alt Linux

Centos

Graphicsmagick

Imagemagick

Red Hat

Suse

Ubuntu

References · 132

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/1454 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/306c1f0fa5754ca78efd16ab752f0e981d4f6b82 · Patch
• https://linux.oracle.com/errata/ELSA-2020-1180.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27759 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16323 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7397 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27776 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11472 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27769 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27755 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27764 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17966 · Vendor Advisory