CVE-2019-13299 - ImageMagick: heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel

HIGH

ImageMagick: heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel

Published Jul 5, 2019

8.8

HIGH

CVSS 3.1

EPSS 2.28%

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	ImageMagick	Out of support scope	n/a
Red Hat Enterprise Linux 6	ImageMagick	Out of support scope	n/a
Red Hat Enterprise Linux 7	ImageMagick	Not affected	n/a

Red Hat statement

This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Weaknesses (1)

CWE-125

Out-of-bounds Read

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-13299		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1730583		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4804		Advisory
https://github.com/ImageMagick/ImageMagick/commit/8187d2d8fd010d2d6b1a3a8edd935beec404dddc		x_refsource_MISCPatch
https://github.com/ImageMagick/ImageMagick/issues/1610		x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-13299
https://www.cve.org/CVERecord?id=CVE-2019-13299