Memory Leak Vulnerability in ImageMagick - CVE-2019-13301
Summary
ALPINE-CVE-2019-13301: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely used open-source software suite for displaying, converting, and editing raster image files. It supports over 200 image formats and provides a robust set of tools for image manipulation. However, certain versions of ImageMagick are vulnerable to memory leaks, which can lead to performance degradation and potential denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2019-13301 is a memory leak issue in ImageMagick versions prior to 6.9.10.53-r0. It originates from an error in the AnnotateImage function, specifically in the AcquireMagickMemory process. This flaw can lead to excessive memory consumption, potentially causing applications to crash or become unresponsive. The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the memory usage of your application or avoid using the AnnotateImage function until the package is updated. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The CVE-2019-13301 vulnerability in ImageMagick poses a risk of memory leaks that can affect application performance. It is crucial to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13301 is a vulnerability in ImageMagick that causes memory leaks due to an error in the AnnotateImage function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The memory leak can lead to increased memory consumption, which may result in application crashes or degraded performance.
Yes, the patched version is 6.9.10.53-r0. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider limiting memory usage or avoiding the use of the AnnotateImage function as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
