WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade imagemagick | Aug 22, 2024 | Aug 18, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ImageMagickUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-perlUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++-develUpgrade ImageMagick-doc | Oct 28, 2020 | Aug 18, 2019 |
| Amazon_linux | — | Upgrade php71-pecl-imagickUpgrade php70-pecl-imagickUpgrade php-pecl-imagickUpgrade php72-pecl-imagickUpgrade php55-pecl-imagickUpgrade php56-pecl-imagickUpgrade ImageMagickUpgrade php54-pecl-imagick | Jul 18, 2020 | Aug 18, 2019 |
| Centos_linux | — | Upgrade ImageMagickUpgrade inkscape-viewUpgrade inkscapeUpgrade inkscape-debuginfoUpgrade autotrace-debuginfoUpgrade inkscape-docsUpgrade autotraceUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-develUpgrade ImageMagick-docUpgrade ImageMagick-debuginfoUpgrade ImageMagick-c++ | Apr 1, 2020 | Aug 18, 2019 |
| Oracle Solaris | — | Upgrade image/imagemagick to version 6.9.10.68-11.4.16.0.1.1.0 on Solaris 11.4 | Dec 18, 2019 | Aug 18, 2019 |
| Oracle_linux | — | Upgrade ImageMagick-c++Upgrade emacs-noxUpgrade ImageMagick-develUpgrade autotrace-develUpgrade ImageMagick-perlUpgrade emacs-terminalUpgrade emacs-elUpgrade ImageMagickUpgrade inkscape-docsUpgrade ImageMagick-c++-develUpgrade emacsUpgrade inkscapeUpgrade autotraceUpgrade ImageMagick-docUpgrade emacs-filesystemUpgrade emacs-commonUpgrade inkscape-view | Oct 5, 2022 | Apr 28, 2019 |
| Redhat_linux | — | Upgrade ImageMagick-develUpgrade inkscape-viewUpgrade inkscape-debuginfoUpgrade ImageMagick-debuginfoUpgrade inkscapeUpgrade autotrace-develNo solution existsUpgrade ImageMagickUpgrade autotrace-debuginfoUpgrade ImageMagick-perlUpgrade inkscape-docsUpgrade ImageMagick-c++Upgrade ImageMagick-docUpgrade autotraceUpgrade ImageMagick-c++-devel | Apr 1, 2020 | Aug 18, 2019 |
| Suse | — | Upgrade libMagickWand-7_Q16HDRI6Upgrade perl-PerlMagickUpgrade libmagick-7_q16hdri4-32bitUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade libMagickWand-6_Q16-1Upgrade libMagick++-6_Q16-3Upgrade libMagickCore-6_Q16-1-32bitUpgrade imagemagick-devel-32bitUpgrade libMagickCore-7_Q16HDRI6Upgrade libmagick-devel-32bitUpgrade ImageMagick-extraUpgrade ImageMagick-config-6-SUSEUpgrade libmagickwand-7_q16hdri6-32bitUpgrade ImageMagickUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagickCore-6_Q16-1Upgrade ImageMagick-config-6-upstreamUpgrade libMagick++-7_Q16HDRI4Upgrade imagemagick-config-7-upstreamUpgrade libMagick++-develUpgrade ImageMagick-config-7-SUSE | Oct 26, 2019 | Aug 18, 2019 |
| Ubuntu | — | Upgrade libmagickwand5 (Ubuntu Pro)Upgrade imagemagick (Ubuntu Pro)Upgrade libmagick++-dev (Ubuntu Pro)Upgrade perlmagick (Ubuntu Pro)Upgrade libmagick++5 (Ubuntu Pro)Upgrade libmagickcore5 (Ubuntu Pro)Upgrade libmagickcore5-extra (Ubuntu Pro)Upgrade libmagickcore-dev (Ubuntu Pro)Upgrade libmagickwand-dev (Ubuntu Pro) | Oct 4, 2024 | Aug 18, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub