Memory leak in ImageMagick - CVE-2019-7397

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17707

Memory leak in ImageMagick - CVE-2019-7397

Published: February 14, 2019


Vulnerability identifier: #VU17707
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7397
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a memory leak in the WritePDFImage function, as defined in the coders/pdf.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.


Affected software

ImageMagick
Amazon Linux AMI
Debian Linux
Opensuse
SUSE Linux
Ubuntu
openEuler
graphicsmagick (Alpine package)
imagemagick6 (Alpine package)
imagemagick (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
GraphicsMagick-devel
GraphicsMagick-debugsource
GraphicsMagick-perl
GraphicsMagick-debuginfo
GraphicsMagick-c++
GraphicsMagick
GraphicsMagick-help
GraphicsMagick-c++-devel
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
ImageMagick
imagemagick (Debian package)

How to mitigate CVE-2019-7397

Update to version 7.0.8-25.

ImageMagick - update to 7.0.8-25
graphicsmagick (Alpine package) - update to 1.3.35-r0
imagemagick6 (Alpine package) - update to 6.9.10.37-r0
imagemagick (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.14, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-2-extra (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagick++-6.q16-5v5 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.14, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
GraphicsMagick-devel - update to 1.3.30-9
GraphicsMagick-debugsource - update to 1.3.30-9
GraphicsMagick-perl - update to 1.3.30-9
GraphicsMagick-debuginfo - update to 1.3.30-9
GraphicsMagick-c++ - update to 1.3.30-9
GraphicsMagick - update to 1.3.30-9
GraphicsMagick-help - update to 1.3.30-9
GraphicsMagick-c++-devel - update to 1.3.30-9
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
ImageMagick - update to 6.9.10.68-3.22
imagemagick (Debian package) - update to 8:6.9.10.23+dfsg-2.1+deb10u1

External References

Related Security Bulletins