CVE-2019-10131
Published: 30 April 2019
An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
imagemagick
Launchpad, Ubuntu, Debian |
bionic |
Released
(8:6.9.7.4+dfsg-16ubuntu6.7)
|
| cosmic |
Not vulnerable
(8:6.9.10.8+dfsg-1ubuntu2)
|
|
| disco |
Not vulnerable
|
|
| focal |
Not vulnerable
|
|
| jammy |
Not vulnerable
|
|
| kinetic |
Not vulnerable
|
|
| lunar |
Not vulnerable
|
|
| mantic |
Not vulnerable
|
|
| noble |
Not vulnerable
|
|
| trusty |
Released
(8:6.7.7.10-6ubuntu3.13+esm9)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(8:6.9.10.2+dfsg-2)
|
|
| xenial |
Released
(8:6.8.9.9-7ubuntu5.14)
|
|
|
Patches:
upstream: https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551b94a794864861592e upstream: https://github.com/ImageMagick/ImageMagick6/commit/7ccc28ee4c777d915f95919ac3bcf8adf93037a7 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.1 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |