CVE-2019-12976: Medium severity IBM Data Risk Manager vulnerability

Q: What is CVE-2019-12976?

CVE-2019-12976 is a vulnerability in ImageMagick that allows a remote attacker to cause a denial of service condition by exploiting a memory leak in the ReadPCLImage function in coders/pcl.c.

Q: How severe is CVE-2019-12976?

CVE-2019-12976 has a severity rating of 5.5 (medium).

Q: How do I fix CVE-2019-12976?

To fix CVE-2019-12976, apply the recommended patches or updates provided by the vendor or software maintainer.

Q: What software versions are affected by CVE-2019-12976?

The affected software versions include ImageMagick 7.0.8-34 and certain versions of Ubuntu, Debian, Canonical Ubuntu Linux, openSUSE Leap, and IBM Data Risk Manager.

Q: Where can I find more information about CVE-2019-12976?

More information about CVE-2019-12976 can be found in the references provided: [Link 1], [Link 2], [Link 3]

Published Jun 26, 2019

Updated

A vulnerability was found in ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c.

Reference: https://github.com/ImageMagick/ImageMagick/issues/1520

Upstream fix: https://github.com/ImageMagick/ImageMagick6/commit/ff840181f631b1b7f29160cae24d792fcd176bae https://github.com/ImageMagick/ImageMagick/commit/c0fe488e7052f68d4eb7768805a857ef6fef928d

Other sources

ImageMagick is vulnerable to a denial of service, caused by a memory leak in the ReadPCLImage function in coders/pcl.c. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.

— IBM

Affected Software

12 affected componentsFixes available

redhat/imagemagick 7.0.8<35

redhat/imagemagick 6.9.10<35

IBM Data Risk Manager<=2.0.6

ImageMagick ImageMagick=7.0.8-34

Debian Debian Linux=10.0

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.04

Canonical Ubuntu Linux=19.10

openSUSE Leap=15.0

openSUSE Leap=15.1

debian/imagemagick

8:6.9.11.60+dfsg-1.3+deb11u48:6.9.11.60+dfsg-1.3+deb11u58:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u18:7.1.1.43+dfsg1-18:7.1.1.47+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/ImageMagick 7.0.8 to a version that resolves this vulnerability.
Fixed in 35
Upgrade
Upgrade redhat/ImageMagick 6.9.10 to a version that resolves this vulnerability.
Fixed in 35
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.3+deb11u4Fixed in 8:6.9.11.60+dfsg-1.3+deb11u5Fixed in 8:6.9.11.60+dfsg-1.6+deb12u2Fixed in 8:6.9.11.60+dfsg-1.6+deb12u1Fixed in 8:7.1.1.43+dfsg1-1Fixed in 8:7.1.1.47+dfsg1-1

Event History

Jun 26, 2019

CVE Published

via MITRE·05:08 PM

Data Sourced

via MITRE·05:08 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

IBM-6335281

Frequently Asked Questions

What is CVE-2019-12976?