Heap-Based Buffer Overflow in ImageMagick - CVE-2019-13307
Summary
ALPINE-CVE-2019-13307: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely used open-source software suite for displaying, converting, and editing raster image files. It supports a multitude of image formats and provides a robust set of features for image manipulation. However, certain versions of ImageMagick are vulnerable to a heap-based buffer overflow, which can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2019-13307 is a heap-based buffer overflow that occurs in the EvaluateImages function within the MagickCore/statistic.c file of ImageMagick version 7.0.8-50 Q16. This flaw arises from improper handling of image rows, which can be exploited by attackers to execute arbitrary code, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the vulnerable functionality or restrict the input images to trusted sources until the package is updated.
Conclusion
CVE-2019-13307 represents a significant security risk for users of ImageMagick due to a heap-based buffer overflow vulnerability. It is crucial for users to update to the patched version to mitigate potential threats. Regular monitoring and using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13307 is a vulnerability in ImageMagick that allows for a heap-based buffer overflow, potentially leading to arbitrary code execution.
The vulnerability affects ImageMagick versions prior to 6.9.10.53-r0.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without any signup.
The CVSS score for CVE-2019-13307 is 7.8, indicating a high severity level.
If immediate updates are not feasible, consider implementing restrictions on input images and monitoring for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
