Division by zero in ImageMagick - CVE-2019-14981

Vulnerability identifier: #VU20299

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14981

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to division by zero error when processing untrusted input in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. A remote attacker can perform denial of service attack.

ImageMagick
Amazon Linux AMI
Debian Linux
Opensuse
Ubuntu
imagemagick6 (Alpine package)
imagemagick (Alpine package)
imagemagick-6.q16 (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
imagemagick (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
ImageMagick
imagemagick (Debian package)

Install update from vendor's website.

ImageMagick - update to 7.0.8-41
imagemagick6 (Alpine package) - update to 6.9.10.70-r0
imagemagick (Alpine package) - update to 7.0.8.68-r0
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.15, 8:6.9.7.4+dfsg-16ubuntu6.8, 8:6.9.10.14+dfsg-7ubuntu2.3, 8:6.9.10.23+dfsg-2.1ubuntu3.1
libmagickcore-6.q16-2-extra (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.15
libmagick++-6.q16-5v5 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.15
libmagickcore-6.q16-2 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.15
imagemagick (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.15, 8:6.9.7.4+dfsg-16ubuntu6.8, 8:6.9.10.14+dfsg-7ubuntu2.3, 8:6.9.10.23+dfsg-2.1ubuntu3.1
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.8
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.8
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.8
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.14+dfsg-7ubuntu2.3, 8:6.9.10.23+dfsg-2.1ubuntu3.1
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.14+dfsg-7ubuntu2.3, 8:6.9.10.23+dfsg-2.1ubuntu3.1
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.14+dfsg-7ubuntu2.3, 8:6.9.10.23+dfsg-2.1ubuntu3.1
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
ImageMagick - update to 6.9.10.68-3.22
imagemagick (Debian package) - update to 8:6.9.10.23+dfsg-2.1+deb10u1

• https://github.com/ImageMagick/ImageMagick/commit/a77d8d97f5a7bced0468f0b08798c83fb67427bc
• https://github.com/ImageMagick/ImageMagick/issues/1552
• https://github.com/ImageMagick/ImageMagick6/commit/b522d2d857d2f75b659936b59b0da9df1682c256

• Denial of service in ImageMagick
• OpenSUSE Linux update for ImageMagick
• OpenSUSE Linux update for ImageMagick
• Division by zero in imagemagick6 (Alpine package)
• Division by zero in imagemagick (Alpine package)
• Debian update for imagemagick
• Amazon Linux AMI update for php72-pecl-imagick
• Amazon Linux AMI update for php71-pecl-imagick
• Amazon Linux AMI update for php70-pecl-imagick
• Amazon Linux AMI update for php55-pecl-imagick
• Amazon Linux AMI update for php56-pecl-imagick
• Amazon Linux AMI update for php54-pecl-imagick
• Amazon Linux AMI update for ImageMagick
• Ubuntu update for imagemagick