Heap-Based Buffer Over-Read in ImageMagick - CVE-2019-13302
Summary
ALPINE-CVE-2019-13302: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely used open-source software suite for displaying, converting, and editing raster image files. It supports a multitude of image formats and provides a robust set of features for image manipulation. However, certain versions of ImageMagick are vulnerable to a heap-based buffer over-read, which can lead to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2019-13302 affects ImageMagick versions prior to 6.9.10.53-r0. It originates from a flaw in the MagickCore/fourier.c file, specifically in the ComplexImages function. This flaw allows an attacker to exploit a heap-based buffer over-read, which could lead to unauthorized access to sensitive data or application crashes. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the ImageMagick functionality or disabling features that utilize the vulnerable components until the package can be updated.
Conclusion
CVE-2019-13302 represents a significant security risk for users of ImageMagick versions prior to 6.9.10.53-r0. It is crucial to update to the patched version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13302 is a vulnerability in ImageMagick that allows for a heap-based buffer over-read, potentially leading to data exposure or application crashes.
ImageMagick versions prior to 6.9.10.53-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing access restrictions or disabling vulnerable features as a temporary workaround.
The CVSS score for CVE-2019-13302 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
