Heap-based Buffer Overflow in GraphicsMagick Software
CVE-2018-20184

6.5MEDIUM

Key Information:

Vendor

Graphicsmagick

Status
Graphicsmagick
Vendor
CVE Published:
17 December 2018

What is CVE-2018-20184?

In GraphicsMagick, specifically version 1.4 snapshot-20181209 Q8, a vulnerability exists within the WriteTGAImage function in tga.c. This flaw can lead to a heap-based buffer overflow, enabling an attacker to manipulate crafted TGA image files. If the dimensions specified for the image exceed the constraints laid out by the TGA specification, it can be exploited to execute a denial of service attack, disrupting normal operations. It is critical for users to stay informed about this vulnerability and implement necessary precautions to safeguard their systems.

References

http://www.securityfocus.com/bid/106229
vdb-entryx_refsource_BID
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/15d1b5...
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018/12/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.