In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagick++-6_Q16-3Upgrade ImageMagickUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagickWand-6_Q16-1Upgrade libgraphicsmagick-q16-3Upgrade libMagickCore-7_Q16HDRI6Upgrade perl-GraphicsMagickUpgrade libMagick++-develUpgrade ImageMagick-config-6-SUSEUpgrade ImageMagick-config-6-upstreamUpgrade imagemagick-config-7-upstreamUpgrade libgraphicsmagick-q16-12Upgrade libMagick++-7_Q16HDRI4Upgrade perl-PerlMagickUpgrade ImageMagick-extraUpgrade libmagick-7_q16hdri4-32bitUpgrade ImageMagick-docUpgrade libgraphicsmagickwand-q16-2Upgrade ImageMagick-develUpgrade graphicsmagick-develUpgrade ImageMagick-config-7-SUSEUpgrade GraphicsMagickUpgrade imagemagick-devel-32bitUpgrade libMagickCore-6_Q16-1Upgrade libmagickwand-7_q16hdri6-32bitUpgrade libmagick-devel-32bitUpgrade libgraphicsmagick-develUpgrade libMagickWand-7_Q16HDRI6Upgrade libgraphicsmagick3-config | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagickUpgrade libgraphicsmagick++-q16-12 | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub