SB2019011712 - Denial of service in ImageMagick
Published: January 17, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2019-7396)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the ReadSIXELImage function, as defined in the coders/sixel.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
2) Memory leak (CVE-ID: CVE-2019-7398)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WriteDIBImage function, as defined in the coders/dib.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
3) Memory leak (CVE-ID: CVE-2019-7395)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WritePSDChannel function, as defined in the coders/psd.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
4) Memory leak (CVE-ID: CVE-2019-7397)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WritePDFImage function, as defined in the coders/pdf.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
Remediation
Install update from vendor's website.