In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | May 21, 2019 | Apr 24, 2019 |
| Suse | — | Upgrade imagemagick-devel-32bitUpgrade libMagickWand-7_Q16HDRI6Upgrade libmagickcore-7_q16hdri6-32bitUpgrade libMagickCore-6_Q16-1-32bitUpgrade libgraphicsmagick-q16-3Upgrade libMagickCore-7_Q16HDRI6Upgrade libgraphicsmagickwand-q16-2Upgrade libgraphicsmagick-develUpgrade libmagick-7_q16hdri4-32bitUpgrade libMagick++-6_Q16-3Upgrade ImageMagick-develUpgrade libMagick++-develUpgrade libmagick-devel-32bitUpgrade libMagickWand-6_Q16-1Upgrade libMagickCore-6_Q16-1Upgrade libgraphicsmagick-q16-12Upgrade libmagickwand-7_q16hdri6-32bitUpgrade perl-PerlMagickUpgrade ImageMagick-config-6-upstreamUpgrade imagemagick-config-7-upstreamUpgrade libMagick++-7_Q16HDRI4Upgrade ImageMagick-extraUpgrade ImageMagick-docUpgrade GraphicsMagickUpgrade graphicsmagick-develUpgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-6-SUSEUpgrade libgraphicsmagick3-configUpgrade perl-GraphicsMagickUpgrade ImageMagick | May 9, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick-q16-3Upgrade libgraphicsmagick++-q16-12Upgrade graphicsmagick | Dec 4, 2019 | Apr 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub