Memory Leak Vulnerability in ImageMagick Package - CVE-2019-13310
Summary
ALPINE-CVE-2019-13310: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. Affects imagemagick versions < 6.9.10.53-r0. Fixed in 6.9.10.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is a widely-used open-source software suite for displaying, converting, and editing raster image files. It supports a variety of image formats and provides a robust set of features for image manipulation. However, certain versions of ImageMagick are vulnerable to memory leaks, which can lead to increased resource consumption and potential denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2019-13310 affects ImageMagick versions prior to 6.9.10.53-r0. It originates from an error in the MagickWand/mogrify.c file, specifically at the AcquireMagickMemory function. This flaw can lead to memory leaks, causing the application to consume excessive memory over time, which may result in degraded performance or crashes. The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
How To Fix
Minimum fixed version
6.9.10.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the memory usage of ImageMagick by configuring system resource limits or by using alternative image processing tools until the package is updated.
Conclusion
In summary, CVE-2019-13310 is a memory leak vulnerability in ImageMagick that can lead to significant performance issues. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in your software.
See every vulnerability recorded for imagemagick →
FAQ
CVE-2019-13310 is a vulnerability in ImageMagick that causes memory leaks due to an error in the code, potentially leading to performance issues.
Versions of ImageMagick prior to 6.9.10.53-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The memory leak can lead to increased memory consumption, which may result in application slowdowns or crashes, impacting user experience.
Yes, you can limit the memory usage of ImageMagick or use alternative image processing tools as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
