In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-docUpgrade ImageMagick-develUpgrade ImageMagick-extraUpgrade libmagick-devel-32bitUpgrade perl-PerlMagickUpgrade libMagick++-develUpgrade GraphicsMagickUpgrade libmagick-7_q16hdri4-32bitUpgrade libgraphicsmagickwand-q16-2Upgrade libgraphicsmagick-develUpgrade libMagickCore-7_Q16HDRI6Upgrade imagemagick-devel-32bitUpgrade libMagickCore-6_Q16-1Upgrade libMagick++-7_Q16HDRI4Upgrade libMagickWand-7_Q16HDRI6Upgrade libgraphicsmagick-q16-12Upgrade libmagickwand-7_q16hdri6-32bitUpgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-6-SUSEUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagick++-6_Q16-3Upgrade libgraphicsmagick-q16-3Upgrade ImageMagickUpgrade perl-GraphicsMagickUpgrade libgraphicsmagick3-configUpgrade imagemagick-config-7-upstreamUpgrade graphicsmagick-develUpgrade ImageMagick-config-6-upstream | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick++-q16-12Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagick | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub