Division by zero in ImageMagick - CVE-2019-11472

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32024

Division by zero in ImageMagick - CVE-2019-11472

Published: April 23, 2019 / Updated: July 28, 2020


Vulnerability identifier: #VU32024
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11472
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.


Affected software

ImageMagick
Amazon Linux AMI
Debian Linux
Fedora
Ubuntu
Opensuse
imagemagick6 (Alpine package)
libmagickcore-dev (Ubuntu package)
imagemagick (Ubuntu package)
libmagickcore5 (Ubuntu package)
libmagickwand5 (Ubuntu package)
perlmagick (Ubuntu package)
libmagick++-dev (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
libmagickwand-dev (Ubuntu package)
libmagick++5 (Ubuntu package)
imagemagick-common (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
GraphicsMagick
php70-pecl-imagick
php71-pecl-imagick
php72-pecl-imagick
php54-pecl-imagick
php55-pecl-imagick
php56-pecl-imagick
ImageMagick
imagemagick (Debian package)

How to mitigate CVE-2019-11472

Install update from vendor's website.

imagemagick6 (Alpine package) - addressed in versions 6.9.10.43-r0, 6.9.10.44-r0, 6.9.10.68-r0
libmagickcore-dev (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
imagemagick (Ubuntu package) - addressed in versions 8:6.7.7.10-6ubuntu3.13+esm9, 8:6.8.9.9-7ubuntu5.14, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
libmagickwand5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
perlmagick (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
libmagick++-dev (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
libmagickcore5-extra (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
libmagickwand-dev (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
libmagick++5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
imagemagick-common (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.13+esm9
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-7ubuntu5.14, 8:6.9.7.4+dfsg-16ubuntu6.7, 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagick++-6.q16-5v5 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2-extra (Ubuntu package) - update to 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.8+dfsg-1ubuntu2.2, 8:6.9.10.14+dfsg-7ubuntu2.2
GraphicsMagick - addressed in versions 1.3.32-1.fc29, 1.3.32-1.fc30, 1.3.34-1.el7, 1.3.34-1.el8
php70-pecl-imagick - update to 3.4.4-1.7
php71-pecl-imagick - update to 3.4.4-2.8
php72-pecl-imagick - update to 3.4.4-2.10
php54-pecl-imagick - update to 3.4.4-2.11
php55-pecl-imagick - update to 3.4.4-2.15
php56-pecl-imagick - update to 3.4.4-2.16
ImageMagick - update to 6.9.10.68-3.22
imagemagick (Debian package) - update to 8:6.9.10.23+dfsg-2.1+deb10u1

External References

Related Security Bulletins