Multiple vulnerabilities in ImageMagick
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2019-12974 CVE-2019-12975 CVE-2019-12976 CVE-2019-12977 CVE-2019-12978 CVE-2019-12979 |
| CWE-ID | CWE-476 CWE-399 CWE-401 CWE-665 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
ImageMagick Client/Desktop applications / Multimedia software |
| Vendor | ImageMagick.org |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU35780
Risk: Medium
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12974
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted image.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1515
http://lists.debian.org/debian-lts-announce/2019/08/msg00021.html
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Resource management error
EUVDB-ID: #VU35781
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12975
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1517
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Memory leak
EUVDB-ID: #VU35782
Risk: Medium
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12976
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the ReadPCLImage function in coders/pcl.c. A remote attacker can perform a denial of service attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1520
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper Initialization
EUVDB-ID: #VU35783
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12977
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1518
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Improper Initialization
EUVDB-ID: #VU35784
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12978
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1519
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improper Initialization
EUVDB-ID: #VU35785
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-12979
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.
MitigationInstall update from vendor's website.
Vulnerable software versionsImageMagick: 7.0.8-34
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
http://www.securityfocus.com/bid/108913
http://github.com/ImageMagick/ImageMagick/issues/1522
http://usn.ubuntu.com/4192-1/
http://www.debian.org/security/2020/dsa-4712
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
