Heap-Based Buffer Overflow in ImageMagick - CVE-2019-13300
Summary
ALPINE-CVE-2019-13300: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely-used open-source software suite for displaying, converting, and editing raster image files. It supports a variety of image formats and provides a rich set of features for image manipulation. However, certain versions of ImageMagick are vulnerable to a heap-based buffer overflow, which can lead to severe security issues.
Vulnerability Detail
The vulnerability identified as CVE-2019-13300 is a heap-based buffer overflow that occurs in ImageMagick version 7.0.8-50 Q16, specifically in the MagickCore/statistic.c file. This issue arises from improper handling of columns during image evaluation, which can allow an attacker to exploit the overflow and potentially execute arbitrary code, leading to unauthorized access or system compromise.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the vulnerable versions of ImageMagick until they can apply the update. Additionally, limiting access to the application or restricting the types of images processed may help mitigate the risk.
Conclusion
CVE-2019-13300 represents a significant security risk for users of ImageMagick due to a heap-based buffer overflow vulnerability. It is crucial for users to update to the patched version to protect their systems from potential exploitation.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13300 is a vulnerability in ImageMagick that allows for a heap-based buffer overflow, potentially leading to arbitrary code execution.
The vulnerability affects ImageMagick versions prior to 6.9.10.53-r0 across Alpine Linux distributions v3.8, v3.9, and v3.10.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, or system compromise.
The CVSS score for CVE-2019-13300 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
