In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagick | May 21, 2019 | Apr 24, 2019 |
| Suse | — | Upgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-6-SUSEUpgrade libgraphicsmagick-q16-12Upgrade libMagick++-7_Q16HDRI4Upgrade GraphicsMagickUpgrade libgraphicsmagick3-configUpgrade perl-GraphicsMagickUpgrade libMagickCore-6_Q16-1Upgrade ImageMagick-docUpgrade perl-PerlMagickUpgrade imagemagick-config-7-upstreamUpgrade ImageMagick-config-6-upstreamUpgrade libmagickwand-7_q16hdri6-32bitUpgrade graphicsmagick-develUpgrade ImageMagick-extraUpgrade ImageMagickUpgrade libMagick++-6_Q16-3Upgrade libgraphicsmagick-q16-3Upgrade libMagickWand-7_Q16HDRI6Upgrade libgraphicsmagickwand-q16-2Upgrade libMagick++-develUpgrade imagemagick-devel-32bitUpgrade libMagickCore-7_Q16HDRI6Upgrade libmagick-devel-32bitUpgrade libMagickWand-6_Q16-1Upgrade libgraphicsmagick-develUpgrade ImageMagick-develUpgrade libMagickCore-6_Q16-1-32bitUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libmagick-7_q16hdri4-32bit | May 9, 2019 | Apr 24, 2019 |
| Ubuntu | — | Upgrade libgraphicsmagick-q16-3Upgrade graphicsmagickUpgrade libgraphicsmagick++-q16-12 | Dec 4, 2019 | Apr 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub