In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade libgraphicsmagick-q16-12Upgrade imagemagick-develUpgrade libgraphicsmagick-q16-3Upgrade imagemagick-config-6-suseUpgrade perl-perlmagickUpgrade imagemagick-config-6-upstreamUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libmagick-7_q16hdri4Upgrade libmagickwand-6_q16-1Upgrade imagemagick-config-7-upstreamUpgrade libmagickcore-6_q16-1Upgrade imagemagick-config-7-suseUpgrade imagemagick-extraUpgrade libmagickwand-7_q16hdri6Upgrade libmagick-6_q16-3Upgrade imagemagick-devel-32bitUpgrade graphicsmagickUpgrade libmagick-7_q16hdri4-32bitUpgrade libmagickcore-6_q16-1-32bitUpgrade libmagickcore-7_q16hdri6Upgrade libgraphicsmagick3-configUpgrade graphicsmagick-develUpgrade perl-graphicsmagickUpgrade libmagickwand-7_q16hdri6-32bitUpgrade libmagick-develUpgrade libgraphicsmagickwand-q16-2Upgrade libgraphicsmagick-develUpgrade imagemagickUpgrade libmagick-devel-32bitUpgrade imagemagick-doc | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagickUpgrade libgraphicsmagick++-q16-12 | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub