PT-2019-5874 · Imagemagick+4 · Imagemagick+4

Hongxuchen · Published 2019-04-23 · Updated 2024-09-04 · CVE-2019-11472

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-41 Q16

Description The issue is related to a denial-of-service (divide-by-zero error) in the XWD image parsing component of ImageMagick. This can be triggered by crafting a specific XWD image file where the header does not indicate whether the data is stored in least significant bit (LSB) first or most significant bit (MSB) first order. An attacker could exploit this vulnerability to cause a denial-of-service.

Recommendations For ImageMagick version 7.0.8-41 Q16, consider avoiding the use of the ReadXWDImage function in coders/xwd.c until a patch is available. As a temporary workaround, restrict the processing of XWD image files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BDU:2021-03542

CESA-2020_1180

CVE-2019-11472

DLA-2333-1

DSA-4712-1

OPENSUSE-SU-2019:1603-1

OPENSUSE-SU-2019_1603-1

OPENSUSE-SU-2019_1683-1

RHSA-2020:1180

RHSA-2020_1180

SUSE-SU-2019:1523-1

SUSE-SU-2019:1712-1

USN-4034-1

USN-6985-1

Affected Products

Centos

Imagemagick

Red Hat

Suse

Ubuntu

References · 92

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/1546 · Exploit
• https://github.com/ImageMagick/ImageMagick6/commit/f663dfb8431c97d95682a2b533cca1c8233d21b4 · Patch
• https://usn.ubuntu.com/4034-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11472 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00057.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18023 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1603-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00001.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10650 · Vendor Advisory