Out-of-bounds read in ImageMagick - CVE-2019-13391

Vulnerability identifier: #VU19184

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13391

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read because of incorrect calls to "GetCacheViewVirtualPixels" in the "ComplexImages" function, as defined in the "MagickCore/fourier.c" file. A remote attacker can make calls on the targeted system and perform a denial of service attack.

ImageMagick
imagemagick6 (Alpine package)
imagemagick (Ubuntu package)
Ubuntu
Opensuse

Install update from vendor's website.

ImageMagick - update to 7.0.8-51
imagemagick6 (Alpine package) - addressed in versions 6.9.10.55-r0, 6.9.10.56-r0, 6.9.10.68-r0
imagemagick (Ubuntu package) - addressed in versions 8:6.7.7.10-6ubuntu3.13+esm21, 8:6.8.9.9-7ubuntu5.16+esm20, 8:6.9.7.4+dfsg-16ubuntu6.15+esm12, 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10, 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9, 8:7.1.2.3+dfsg1-1ubuntu0.1

• https://github.com/ImageMagick/ImageMagick/commit/7c2c5ba5b8e3a0b2b82f56c71dfab74ed4006df7
• https://github.com/ImageMagick/ImageMagick/issues/1588
• https://github.com/ImageMagick/ImageMagick6/commit/f6ffc702c6eecd963587273a429dcd608c648984

• Multiple vulnerabilities in ImageMagick
• Out-of-bounds read in imagemagick6 (Alpine package)
• OpenSUSE Linux update for ImageMagick
• Ubuntu update for imagemagick