CVE-2019-9956
imagemagick: stack-based buffer overflow in function PopHexPixel in coders/ps.c
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
Se ha encontrado una vulnerabilidad de desbordamiento de búfer basado en pila en ImageMagick 7.0.8-35 Q16 en la función PopHexPixel en coders/ps.c. Esta vulnerabilidad permite que los atacantes provoquen una denegación de servicio mediante un archivo de imagen manipulado.
ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Issues addressed include buffer overflow, denial of service, double free, information leakage, null pointer, out of bounds read, out of bounds write, and use-after-free vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-23 CVE Reserved
- 2019-03-23 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-121: Stack-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/107546 | Third Party Advisory | |
| http://www.securityfocus.com/bid/107672 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html | Mailing List |
|
| https://seclists.org/bugtraq/2019/Apr/37 | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/ImageMagick/ImageMagick/issues/1523 | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html | 2020-08-24 | |
| http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00010.html | 2020-08-24 | |
| https://usn.ubuntu.com/4034-1 | 2020-08-24 | |
| https://www.debian.org/security/2019/dsa-4436 | 2020-08-24 | |
| https://access.redhat.com/security/cve/CVE-2019-9956 | 2020-03-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1692300 | 2020-03-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | 7.0.8-35 Search vendor "Imagemagick" for product "Imagemagick" and version "7.0.8-35" | q16 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||