cbcvebase.
CVE-2019-19953
published 2019-12-24

CVE-2019-19953: In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.

PriorityP338critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
2.78%
84.8th percentile
In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.

Affected

15 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debiandebian_linux
debiandebian_linux
debiangraphicsmagick< graphicsmagick 1.4+really1.3.34-1 (bookworm)graphicsmagick 1.4+really1.3.34-1 (bookworm)
graphicsmagickgraphicsmagick
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.34-11.4+really1.3.34-1
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.34-11.4+really1.3.34-1
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.34-11.4+really1.3.34-1
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.34-11.4+really1.3.34-1
graphicsmagickgraphicsmagick>= 0 < 1.3.18-1ubuntu3.1+esm71.3.18-1ubuntu3.1+esm7
graphicsmagickgraphicsmagick>= 0 < 1.3.23-1ubuntu0.6+esm11.3.23-1ubuntu0.6+esm1
graphicsmagickgraphicsmagick>= 0 < 1.3.28-2ubuntu0.1+esm11.3.28-2ubuntu0.1+esm1
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-1ubuntu0.1~esm11.4+really1.3.35-1ubuntu0.1~esm1
opensusebackports
opensuseleap

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.