Memory Leak Vulnerability in ImageMagick Package - CVE-2019-13309
Summary
ALPINE-CVE-2019-13309: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely-used open-source software suite for displaying, converting, and editing raster image files. It supports a variety of image formats and provides a rich set of features for image manipulation. However, certain versions of ImageMagick are vulnerable to memory leaks due to mishandling errors, which can lead to increased resource consumption and potential denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2019-13309 affects ImageMagick versions prior to 6.9.10.53-r0. It originates from a flaw in the CLIListOperatorImages function within the MagickWand operation.c file, where the NoSuchImage error is mishandled. This can lead to memory leaks at the AcquireMagickMemory function, potentially exhausting system resources and causing application crashes or slowdowns.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the number of concurrent image processing tasks or monitor memory usage closely to prevent system overload until the package can be updated.
Conclusion
In summary, CVE-2019-13309 is a significant memory leak vulnerability in the ImageMagick package that can lead to resource exhaustion. Users are advised to update to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13309 is a vulnerability in ImageMagick that causes memory leaks due to mishandling errors in image processing.
The vulnerability affects ImageMagick versions prior to 6.9.10.53-r0.
The memory leak can lead to increased resource consumption, application crashes, or slow performance.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
