In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | May 21, 2019 | Apr 24, 2019 |
| Suse | — | Upgrade ImageMagick-docUpgrade libMagickWand-6_Q16-1Upgrade perl-PerlMagickUpgrade libMagickCore-7_Q16HDRI6Upgrade libMagickCore-6_Q16-1-32bitUpgrade libmagick-devel-32bitUpgrade GraphicsMagickUpgrade libMagick++-develUpgrade ImageMagick-extraUpgrade libgraphicsmagickwand-q16-2Upgrade libmagickcore-7_q16hdri6-32bitUpgrade ImageMagickUpgrade ImageMagick-develUpgrade libgraphicsmagick-q16-12Upgrade libMagick++-6_Q16-3Upgrade libmagickwand-7_q16hdri6-32bitUpgrade perl-GraphicsMagickUpgrade graphicsmagick-develUpgrade imagemagick-devel-32bitUpgrade libgraphicsmagick-develUpgrade ImageMagick-config-6-upstreamUpgrade libMagickWand-7_Q16HDRI6Upgrade libMagickCore-6_Q16-1Upgrade libMagick++-7_Q16HDRI4Upgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-6-SUSEUpgrade imagemagick-config-7-upstreamUpgrade libgraphicsmagick-q16-3Upgrade libgraphicsmagick3-configUpgrade libmagick-7_q16hdri4-32bit | May 9, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick++-q16-12Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagick | Dec 4, 2019 | Apr 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub