CVE-2018-20185: Medium severity GraphicsMagick Graphicsmagick vulnerability

Published Dec 17, 2018

Updated

In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.

Affected Software

6 affected componentsFixes available

debian/graphicsmagick

1.4+really1.3.36+hg16481-2+deb11u11.4+really1.3.40-41.4+really1.3.45+hg17689-1

GraphicsMagick Graphicsmagick=1.4-2018-12-09

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Canonical Ubuntu Linux=18.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/graphicsmagick to a version that resolves this vulnerability.
Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4Fixed in 1.4+really1.3.45+hg17689-1

Event History

Dec 17, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the vulnerability ID of this GraphicsMagick vulnerability?

The vulnerability ID of this GraphicsMagick vulnerability is CVE-2018-20185.

What is the severity of CVE-2018-20185?

The severity of CVE-2018-20185 is medium with a CVSS score of 5.3.

How does CVE-2018-20185 impact GraphicsMagick on 32-bit platforms?

CVE-2018-20185 in GraphicsMagick on 32-bit platforms can cause a denial of service through a heap-based buffer over-read in the ReadBMPImage function of bmp.c.

Which versions of GraphicsMagick are affected by CVE-2018-20185?

GraphicsMagick versions 1.4 snapshot-20181209 to 1.4 with Q8 on 32-bit platforms are affected by CVE-2018-20185.

How can I fix CVE-2018-20185?

To fix CVE-2018-20185, it is recommended to update to GraphicsMagick version 1.4+really1.3.35-1~deb10u2 or higher.