CVE-2019-17541

Опубликовано: 14 окт. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Ссылки

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
Issue Tracking
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba7551124493
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1641
Exploit
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
Issue Tracking
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba7551124493
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1641
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Версия до 6.9.10-55 (исключая)

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Версия от 7.0.0-0 (включая) до 7.0.8-55 (исключая)

EPSS

Процентиль: 49%

0.00261

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2019-17541

CVSS3: 8.8

ubuntu

почти 6 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

CVE-2019-17541

CVSS3: 7.8

redhat

около 6 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

CVE-2019-17541

CVSS3: 8.8

debian

почти 6 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo ...

GHSA-p8cw-ccq5-gwg9

github

около 3 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

ELSA-2020-1180

oracle-oval

больше 5 лет назад

ELSA-2020-1180: ImageMagick security, bug fix, and enhancement update (MODERATE)

EPSS

Процентиль: 49%

0.00261

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416