WID-SEC-W-2023-2131

DeutschShown in its original language — a full translation is planned for a future version.

ImageMagick / GraphicsMagick: Mehrere Schwachstellen ermöglichen Denial of Service

view advisory published 2019-12-23

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ImageMagick und GraphicsMagick ausnutzen, um einen Denial of Service Angriff durchzuführen.

describes (6)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-19953US	critical9.1	2.44% (84th)	—	2019-12-24
In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.
CVE-2019-19952US	critical9.8	2.23% (83rd)	—	2019-12-24
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to ReadOneMNGImage.
CVE-2019-19951US	critical9.8	2.57% (85th)	—	2019-12-24
In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c.
CVE-2019-19950US	critical9.8	2.37% (84th)	—	2019-12-24
In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c.
CVE-2019-19949US	critical9.1	2.89% (87th)	—	2019-12-24
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.
CVE-2019-19948US	critical9.8	3.68% (90th)	—	2019-12-24
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan