CVE-2019-11009: High severity GraphicsMagick Graphicsmagick vulnerability
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-11009.
What is the severity of CVE-2019-11009?
The severity of CVE-2019-11009 is high.
Which software versions are affected by CVE-2019-11009?
Versions 1.4+really1.3.35-1~deb10u2, 1.4+really1.3.35-1~deb10u3, 1.4+really1.3.36+hg16481-2+deb11u1, 1.4+really1.3.40-4, 1.4+really1.3.42-1 of GraphicsMagick, and version 1.3.28-2ubuntu0.1 of graphicsmagick in Ubuntu 18.04 LTS (Bionic Beaver) are affected by CVE-2019-11009.
How can attackers exploit CVE-2019-11009?
Attackers can exploit CVE-2019-11009 by using a crafted image file to cause a denial of service or information disclosure.
How can I mitigate the vulnerability CVE-2019-11009?
To mitigate the vulnerability CVE-2019-11009, update GraphicsMagick to version 1.4+really1.3.35-1~deb10u2, 1.4+really1.3.35-1~deb10u3, 1.4+really1.3.36+hg16481-2+deb11u1, 1.4+really1.3.40-4, or 1.4+really1.3.42-1, and update graphicsmagick in Ubuntu 18.04 LTS (Bionic Beaver) to version 1.3.28-2ubuntu0.1.