CVE-2018-20185
Debian Security Advisory 4640-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.
Hay una sobrelectura de búfer basada en memoria dinámica (heap) en GraphicsMagick 1.4 snapshot-20181209 Q8 en plataformas de 32 bits, en la función ReadBMPImage de bmp.c que permite que atacantes provoquen una denegación de servicio (DoS) mediante un archivo de imagen bmp manipulado. Esto solo afecta a instalaciones de GraphicsMagick con límites BMP personalizados.
handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed media files are processed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-12-17 CVE Reserved
- 2018-12-17 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/106229 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/12/msg00018.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://sourceforge.net/p/graphicsmagick/bugs/582 | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e3977a293 | 2020-08-18 |
| URL | Date | SRC |
|---|---|---|
| https://usn.ubuntu.com/4207-1 | 2020-08-18 | |
| https://www.debian.org/security/2020/dsa-4640 | 2020-08-18 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Graphicsmagick Search vendor "Graphicsmagick" | Graphicsmagick Search vendor "Graphicsmagick" for product "Graphicsmagick" | 1.4 Search vendor "Graphicsmagick" for product "Graphicsmagick" and version "1.4" | 2018-12-09 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||