In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of     coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.
    (CVE-2019-11010)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update fixes several vulnerabilities in Graphicsmagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed media files are processed.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4207-1 advisory.

    It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly     use this issue to cause a denial of service or other unspecified impact.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for GraphicsMagick fixes the following issues :

  - CVE-2019-11005: Fixed a stack-based buffer overflow in     SVGStartElement of coders/svg.c that allowed attackers     to cause DOS or an unspecified impact (boo#1132058)

  - CVE-2019-11006: Fixed a heap-based buffer over-read in     the function ReadMIFFImage of coders/miff.c that allowed     attackers to cause DOS or information disclosure     (boo#1132061)

  - CVE-2019-11010: Fixed a memory leak in ReadMPCImage of     coders/mpc.c that which allowed attackers to cause DOS     via a crafted image file (boo#1132055)

  - CVE-2019-11007: Fixed a heap-based buffer over-read in     the ReadMNGImage function of coders/png.c that which     allowed attackers to cause a denial of service or     information disclosure (boo#1132060)

  - CVE-2019-11008: Fixed a heap-based buffer overflow in     the function WriteXWDImage of coders/xwd.c that which     allowed remote attackers to cause DOS or other     unspecified impact (boo#1132054)

  - CVE-2019-11009: Fixed a heap-based buffer over-read in     the function ReadXWDImage of coders/xwd.c that which     allowed attackers to cause DOS or information disclosure     (boo#1132053)

Several security vulnerabilities were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer over-reads and a memory leak may lead to a denial of service or information disclosure.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.20-3+deb8u6.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254009	Linux Distros Unpatched Vulnerability : CVE-2019-11010	Nessus	Misc.	medium
134577	Debian DSA-4640-1 : graphicsmagick - security update	Nessus	Debian Local Security Checks	critical
131696	Ubuntu 18.04 LTS : GraphicsMagick vulnerabilities (USN-4207-1)	Nessus	Ubuntu Local Security Checks	critical
124309	openSUSE Security Update : GraphicsMagick (openSUSE-2019-1272)	Nessus	SuSE Local Security Checks	critical
124036	Debian DLA-1755-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-11010

medium

Tenable Plugins

medium

critical

critical

critical

critical