CVE-2019-13297

Name

CVE-2019-13297

Description

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
Patch	https://github.com/ImageMagick/ImageMagick/commit/604588fc35c7585abb7a9e71f69bb82e4389fefc
Exploit	https://github.com/ImageMagick/ImageMagick/issues/1609
Patch	https://github.com/ImageMagick/ImageMagick6/commit/35c7032723d85eee7318ff6c82f031fa2666b773
Mailing List	https://lists.debian.org/debian-lts-announce/2019/08/msg00021.html
Mailing List	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html
Third Party Advisory	https://usn.ubuntu.com/4192-1/
Third Party Advisory	https://www.debian.org/security/2020/dsa-4712
Mailing List	https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:imagemagick:imagemagick:7.0.8-50:q16::::::`	imagemagick	== None	== 7.0.8-50

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status