Heap-Based Buffer Over-Read Vulnerability in GraphicsMagick by Artifex Software
CVE-2019-11007

8.1HIGH

Key Information:

Vendor

Graphicsmagick

Status
Graphicsmagick
Vendor
CVE Published:
8 April 2019

What is CVE-2019-11007?

The vulnerability in GraphicsMagick allows attackers to exploit a heap-based buffer over-read in the ReadMNGImage function found in coders/png.c. By crafting a malicious image colormap, an attacker can potentially trigger a denial of service or disclose sensitive information, adversely affecting users' systems and application performance.

References

https://sourceforge.net/p/graphicsmagick/bugs/596/
x_refsource_MISC
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/40fc71...
x_refsource_MISC
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/86a929...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.