CVE-2019-17541

Опубликовано: 14 окт. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Ссылки

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
Issue Tracking
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba7551124493
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1641
Exploit
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
Issue Tracking
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba7551124493
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55
Patch
Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1641
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Версия до 6.9.10-55 (исключая)

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Версия от 7.0.0-0 (включая) до 7.0.8-55 (исключая)

EPSS

Процентиль: 84%

0.02396

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2019-17541

CVSS3: 8.8

ubuntu

около 7 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

CVE-2019-17541

CVSS3: 7.8

redhat

больше 7 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

CVE-2019-17541

CVSS3: 8.8

debian

около 7 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo ...

GHSA-p8cw-ccq5-gwg9

github

больше 4 лет назад

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

ALT-PU-2019-2660

CVSS3: 8.8

altlinux

около 7 лет назад

ALT-PU-2019-2660: package `ImageMagick` update to version 6.9.10.63-alt1

EPSS

Процентиль: 84%

0.02396

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416