Memory Leak Vulnerability in ImageMagick - CVE-2019-13134
Summary
ALPINE-CVE-2019-13134: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely-used open-source software suite for displaying, converting, and editing raster image files. It supports a multitude of image formats and provides a robust set of tools for image manipulation. However, certain versions of ImageMagick are susceptible to a memory leak vulnerability, which can lead to increased memory consumption and potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2019-13134, exists in ImageMagick versions prior to 7.0.8-50, specifically within the function ReadVIFFImage in the coders/viff.c file. This memory leak can cause the application to consume excessive memory over time, potentially leading to application crashes or degraded performance. Attackers could exploit this vulnerability by crafting specific image files that trigger the memory leak, resulting in a denial of service.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider limiting the use of ImageMagick to trusted image sources only, and monitor memory usage closely to mitigate potential impacts until a proper update can be applied.
Conclusion
CVE-2019-13134 represents a significant memory leak vulnerability in ImageMagick that can lead to performance issues and denial of service. It is crucial to update to the patched version to ensure the security and stability of your applications.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13134 is a memory leak vulnerability in ImageMagick that can lead to increased memory consumption and potential denial of service.
Versions of ImageMagick prior to 7.0.8-50 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2019-13134 is 5.5, indicating a moderate level of severity.
If you cannot update immediately, limit the use of ImageMagick to trusted sources and monitor memory usage closely.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
