CVE-2019-11010 — Missing Release of Memory after Effective Lifetime in Graphicsmagick

CWE-401 — Missing Release of Memory after Effective Lifetime8 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 30.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GraphicsmagickDebian GraphicsmagickDebian Linux+1 more
Timeline
PublishedApr 8
Latest updateMay 13

Description

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/graphicsmagick< graphicsmagick 1.4~hg15968-1 (bookworm)
▶Debiangraphicsmagick/graphicsmagick< 1.4~hg15968-1+3
▶NVDopensuse/leap15.0, 42.3+1

Also affects: Debian Linux 8.0

Patches

Patch: hg.graphicsmagick.org ↗Patch: sourceforge.net ↗Patch: hg.graphicsmagick.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-3w9p-mc8r-hc9p: In GraphicsMagick 1↗2022-05-13
▶
OSV
CVE-2019-11010: In GraphicsMagick 1↗2019-04-08
▶

📋Vendor Advisories

2
Ubuntu
GraphicsMagick vulnerabilities↗2019-12-03
▶
Debian
CVE-2019-11010: graphicsmagick - In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the functi...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-11010 GraphicsMagick: memory leak in the function ReadMPCImage of coders/mpc.c, leading to a DoS attack. [epel-all]↗2019-04-15
▶
Bugzilla
CVE-2019-11010 GraphicsMagick: memory leak in the function ReadMPCImage of coders/mpc.c, leading to a DoS attack. [fedora-all]↗2019-04-15
▶
Bugzilla
CVE-2019-11010 GraphicsMagick: memory leak in the function ReadMPCImage of coders/mpc.c, leading to a DoS attack.↗2019-04-15
▶