8.8
CVSSv3

CVE-2019-9956

Published: 24/03/2019 Updated: 24/08/2020
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 606
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an malicious user to cause a denial of service or code execution via a crafted image file.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

imagemagick imagemagick 7.0.8-35

debian debian linux 9.0

Vendor Advisories

Synopsis Moderate: ImageMagick security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for ImageMagick, autotrace, emacs, and inkscape is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Mod ...
Debian Bug report logs - #925395 imagemagick: CVE-2019-9956 Package: src:imagemagick; Maintainer for src:imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 24 Mar 2019 10:00:01 UTC Severity: serious Tags: fixed-upst ...
Debian Bug report logs - #926091 imagemagick: CVE-2019-10650: heap-buffer-overflow in WriteTIFFImage of coders/tiffc Package: src:imagemagick; Maintainer for src:imagemagick is ImageMagick Packaging Team <pkg-gmagick-im-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 31 ...
Several security issues were fixed in ImageMagick ...
This update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed For the stable distribution (stretch), these problems have been fixed in version 8:697 ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
Impact: Low Public Date: 2019-03-22 CWE: CWE-121 Bugzilla: 1692300: CVE-2019-9956 imagemagick: stack-ba ...
A stack-based buffer overflow has been found in ImageMagick before 708-35, in the WritePSImage() function ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
An issue was discovered in ImageMagick 707 A memory leak vulnerability was found in the function WriteGIFImage in coders/gifc, which allow remote attackers to cause a denial of service via a crafted file (CVE-2017-18254) An issue was discovered in ImageMagick 707 The MogrifyImageList function in MagickWand/mogrifyc allows attackers to caus ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, which allows attackers to cause a denial of service (CVE-2017-1000476) The ReadXWDImage function in coders\xwdc in ImageMagick 705-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of colo ...
Integer overflow in MagickCore/profilec in ImageMagick before 702-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable (CVE-2016-5841) ImageMagick 707-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/ddsc, ...

Github Repositories

Tools to make working with the Arch Linux Security Tracker easier

Arch Linux Security Tracker Tools This is a collection of Python scripts to make working with the Arch Linux Security Tracker easier Features CVE entry extraction from multiple sources (currently Chromium, GitLab, Mozilla, NVD, Oracle and WebKitGTK) into a JSON format consumable by the tracker Automatic batch addition of the extracted CVE entries to the tracker Dependencies

Golang client for cveapi API

cveapi-go Golang client for cveapi API Usage package main import ( "fmt" "githubcom/viiftw/cveapi-go" ) func main() { client := cveapiNewClient() // get cve data cveID := "CVE-2019-9956" cveData, err := clientGetCVEData(cveID) if err != nil { fmtPrintln(err) } else { fmtPrintln(cveDataCveCVEDataMetaID, cveDat