CVE-2018-20189

Name
CVE-2018-20189
Description
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://sourceforge.net/p/graphicsmagick/bugs/585/
Mailing List http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e2b406589
Third Party Advisory http://www.securityfocus.com/bid/106227
Mailing List https://lists.debian.org/debian-lts-announce/2018/12/msg00018.html
UBUNTU https://usn.ubuntu.com/4207-1/
DEBIAN https://www.debian.org/security/2020/dsa-4640

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.31:*:*:*:*:*:*:* graphicsmagick == None == 1.3.31

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
graphicsmagick edge-community 1.3.32-r0 None fixed
graphicsmagick 3.22-community 1.3.32-r0 None fixed
graphicsmagick 3.21-community 1.3.32-r0 None fixed
graphicsmagick 3.20-community 1.3.32-r0 None fixed
graphicsmagick 3.19-community 1.3.32-r0 None fixed
graphicsmagick 3.18-community 1.3.32-r0 None fixed
graphicsmagick 3.17-community 1.3.32-r0 None fixed