CVE-2018-20189: Input Validation
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4Fixed in 1.4+really1.3.45+hg17689-1 - Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.32-r0
Event History
Frequently Asked Questions
What is CVE-2018-20189?
CVE-2018-20189 is a vulnerability found in GraphicsMagick 1.3.31 that allows a crash and denial of service via a crafted dib file.
What is the severity of CVE-2018-20189?
The severity of CVE-2018-20189 is medium with a severity value of 6.5.
How does CVE-2018-20189 affect GraphicsMagick?
CVE-2018-20189 affects GraphicsMagick 1.3.31, causing a crash and denial of service when processing a crafted dib file.
How can I fix CVE-2018-20189?
To fix CVE-2018-20189, you should update your GraphicsMagick installation to version 1.4+really1.3.35-1~deb10u2 or later.
Are there any additional references for CVE-2018-20189?
Yes, you can find more information about CVE-2018-20189 at the following links: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e2b406589, http://www.securityfocus.com/bid/106227, https://lists.debian.org/debian-lts-announce/2018/12/msg00018.html.