In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade libmagick-devel-32bitUpgrade libmagickwand-7_q16hdri6Upgrade graphicsmagickUpgrade libmagick-7_q16hdri4-32bitUpgrade libmagickcore-6_q16-1-32bitUpgrade imagemagick-config-7-suseUpgrade perl-graphicsmagickUpgrade graphicsmagick-develUpgrade libmagick-6_q16-3Upgrade imagemagickUpgrade libgraphicsmagick3-configUpgrade libmagickcore-7_q16hdri6Upgrade imagemagick-extraUpgrade libgraphicsmagick-develUpgrade imagemagick-docUpgrade libmagick-develUpgrade libgraphicsmagickwand-q16-2Upgrade libmagickwand-7_q16hdri6-32bitUpgrade imagemagick-devel-32bitUpgrade imagemagick-develUpgrade perl-perlmagickUpgrade libmagickcore-7_q16hdri6-32bitUpgrade imagemagick-config-7-upstreamUpgrade libgraphicsmagick-q16-3Upgrade libmagick-7_q16hdri4Upgrade imagemagick-config-6-upstreamUpgrade imagemagick-config-6-suseUpgrade libmagickcore-6_q16-1Upgrade libmagickwand-6_q16-1Upgrade libgraphicsmagick-q16-12 | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade graphicsmagickUpgrade libgraphicsmagick++-q16-12Upgrade libgraphicsmagick-q16-3 | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub