In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-docUpgrade libgraphicsmagick-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade GraphicsMagickUpgrade libmagick-devel-32bitUpgrade libMagick++-develUpgrade ImageMagick-extraUpgrade perl-PerlMagickUpgrade libmagick-7_q16hdri4-32bitUpgrade libgraphicsmagickwand-q16-2Upgrade libMagickWand-7_Q16HDRI6Upgrade libMagickCore-6_Q16-1Upgrade libgraphicsmagick-q16-3Upgrade libmagickwand-7_q16hdri6-32bitUpgrade libgraphicsmagick-q16-12Upgrade imagemagick-devel-32bitUpgrade ImageMagick-config-7-SUSEUpgrade libMagick++-7_Q16HDRI4Upgrade imagemagick-config-7-upstreamUpgrade ImageMagickUpgrade graphicsmagick-develUpgrade perl-GraphicsMagickUpgrade ImageMagick-config-6-upstreamUpgrade libMagick++-6_Q16-3Upgrade ImageMagick-config-6-SUSEUpgrade libgraphicsmagick3-configUpgrade libmagickcore-7_q16hdri6-32bit | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick++-q16-12Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagick | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub