Stack-based buffer overflow in GraphicsMagick - CVE-2019-11005

Vulnerability identifier: #VU18363

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11005

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a quoted font family value within the SVGStartElement() function in coders/svg.c in SVG reader. A remote unauthenticated attacker can create a specially crafted image, pass it to the affected application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GraphicsMagick
Debian Linux
Fedora
Opensuse
SUSE Linux
openEuler
graphicsmagick (Ubuntu package)
graphicsmagick (Debian package)
GraphicsMagick
GraphicsMagick-help
GraphicsMagick-c++-devel
GraphicsMagick-c++
GraphicsMagick-debuginfo
GraphicsMagick-perl
GraphicsMagick-debugsource
GraphicsMagick-devel

Update to version 1.3.32 or 1.4 snapshot-20190322 Q8.

GraphicsMagick - update to 1.3.32
graphicsmagick (Ubuntu package) - update to 1.3.28-2ubuntu0.1
graphicsmagick (Debian package) - addressed in versions 1.3.30+hg15796-1~deb9u3, 1.4~hg15978-1+deb10u1
GraphicsMagick - update to 1.3.30-9
GraphicsMagick-help - update to 1.3.30-9
GraphicsMagick-c++-devel - update to 1.3.30-9
GraphicsMagick-c++ - update to 1.3.30-9
GraphicsMagick-debuginfo - update to 1.3.30-9
GraphicsMagick-perl - update to 1.3.30-9
GraphicsMagick-debugsource - update to 1.3.30-9
GraphicsMagick-devel - update to 1.3.30-9
GraphicsMagick - addressed in versions 1.3.34-1.el7, 1.3.34-1.el8

• http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54d
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html
• https://sourceforge.net/p/graphicsmagick/bugs/600/
• http://www.graphicsmagick.org/NEWS.html#june-15-2019

• OpenSUSE Linux update for GraphicsMagick
• Multiple vulnerabilities in GraphicsMagick
• OpenSUSE Linux update for GraphicsMagick
• Ubuntu update for GraphicsMagick
• Debian update for graphicsmagick
• openEuler 20.03 LTS update for GraphicsMagick
• Fedora EPEL 8 update for GraphicsMagick
• Fedora EPEL 7 update for GraphicsMagick