File Reading Vulnerability in GraphicsMagick by GraphicsMagick
CVE-2019-12921

6.5MEDIUM

Key Information:

Vendor

Graphicsmagick

Status
Graphicsmagick
Vendor
CVE Published:
18 March 2020

What is CVE-2019-12921?

A vulnerability in GraphicsMagick prior to version 1.3.32 allows remote attackers to exploit the text filename component. Attackers can craft specific images to gain unauthorized access to arbitrary files. This occurs through the improper handling in the TranslateTextEx function for SVG, potentially exposing sensitive information and leading to further security breaches.

References

http://www.graphicsmagick.org/
x_refsource_MISC
https://github.com/d0ge/data-processing/blob/master/CVE-2...
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2020/03/msg0...
mailing-listx_refsource_MLIST

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.