In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | Apr 15, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade graphicsmagick-develUpgrade libgraphicsmagickwand-q16-2Upgrade perl-PerlMagickUpgrade ImageMagick-config-6-upstreamUpgrade libgraphicsmagick-develUpgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1Upgrade libgraphicsmagick3-configUpgrade GraphicsMagickUpgrade libgraphicsmagick-q16-3Upgrade libMagick++-6_Q16-3Upgrade libgraphicsmagick-q16-12Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-config-6-SUSEUpgrade libMagick++-develUpgrade ImageMagickUpgrade libMagickCore-6_Q16-1-32bitUpgrade perl-GraphicsMagick | Apr 26, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick++-q16-12Upgrade graphicsmagickUpgrade libgraphicsmagick-q16-3 | Dec 4, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub