Division by zero in ImageMagick - CVE-2019-14981

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20299

Division by zero in ImageMagick - CVE-2019-14981

Published: August 19, 2019


Vulnerability identifier: #VU20299
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14981
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to division by zero error when processing untrusted input in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. A remote attacker can perform denial of service attack.


Affected software

ImageMagick
Debian Linux
Amazon Linux AMI
Opensuse
imagemagick6 (Alpine package)
imagemagick (Alpine package)
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
imagemagick (Debian package)
ImageMagick

How to mitigate CVE-2019-14981

Install update from vendor's website.

ImageMagick - update to 7.0.8-41
imagemagick6 (Alpine package) - update to 6.9.10.70-r0
imagemagick (Alpine package) - update to 7.0.8.68-r0
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
imagemagick (Debian package) - update to 8:6.9.10.23+dfsg-2.1+deb10u1
ImageMagick - update to 6.9.10.68-3.22

External References

Related Security Bulletins