CVE-2019-15141 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Imagemagick

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer OverflowCWE-125 — Out-of-bounds Read9 documents7 sources
Severity
6.5MEDIUMNVD
OSV8.1
EPSS
0.1%
top 74.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ImagemagickOpensuse LeapDebian Imagemagick
Timeline
PublishedAug 18
Latest updateOct 3

Description

WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Ubuntuimagemagick/imagemagick< 8:6.8.9.9-7ubuntu5.14+2
▶NVDopensuse/leap15.0, 15.1+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-25x5-8pr2-jjhj: WriteTIFFImage in coders/tiff↗2022-05-24
▶
OSV
CVE-2019-15141: WriteTIFFImage in coders/tiff↗2019-08-18
▶

📋Vendor Advisories

3
Ubuntu
ImageMagick vulnerabilities↗2024-10-03
▶
Red Hat
ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c↗2019-04-28
▶
Debian
CVE-2019-15141: imagemagick - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to ...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-15141 ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c [epel-8]↗2019-11-01
▶
Bugzilla
CVE-2019-15141 ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c [fedora-all]↗2019-11-01
▶
Bugzilla
CVE-2019-15141 ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c↗2019-11-01
▶