In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | May 21, 2019 | Apr 24, 2019 |
| Suse | — | Upgrade perl-PerlMagickUpgrade GraphicsMagickUpgrade libMagickCore-6_Q16-1-32bitUpgrade libMagick++-develUpgrade ImageMagick-extraUpgrade ImageMagick-develUpgrade libMagickCore-7_Q16HDRI6Upgrade libmagick-devel-32bitUpgrade libMagickWand-6_Q16-1Upgrade ImageMagick-docUpgrade ImageMagickUpgrade libgraphicsmagickwand-q16-2Upgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagickCore-6_Q16-1Upgrade graphicsmagick-develUpgrade ImageMagick-config-6-upstreamUpgrade libgraphicsmagick-q16-12Upgrade libMagickWand-7_Q16HDRI6Upgrade libMagick++-6_Q16-3Upgrade libgraphicsmagick-develUpgrade imagemagick-devel-32bitUpgrade ImageMagick-config-6-SUSEUpgrade imagemagick-config-7-upstreamUpgrade libmagickwand-7_q16hdri6-32bitUpgrade libMagick++-7_Q16HDRI4Upgrade libgraphicsmagick3-configUpgrade libgraphicsmagick-q16-3Upgrade libmagick-7_q16hdri4-32bitUpgrade perl-GraphicsMagickUpgrade ImageMagick-config-7-SUSE | May 9, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick++-q16-12Upgrade graphicsmagickUpgrade libgraphicsmagick-q16-3 | Dec 4, 2019 | Apr 24, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub