NVD Vulnerability Detail

CVE-2019-13304

Summary	ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
Publication Date	July 5, 2019, 10:15 a.m.
Registration Date	Jan. 26, 2021, 11:38 a.m.
Last Update	Nov. 21, 2024, 1:24 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick:7.0.8-50:q16::::::

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html	Mailing List Third Party Advisory
3	https://github.com/ImageMagick/ImageMagick/commit/7689875ef64f34141e7292f6945efdf0530b4a5e	Patch
4	https://github.com/ImageMagick/ImageMagick/commit/7689875ef64f34141e7292f6945efdf0530b4a5e	Patch
5	https://github.com/ImageMagick/ImageMagick/issues/1614	Exploit Issue Tracking Patch Third Party Advisory
6	https://github.com/ImageMagick/ImageMagick/issues/1614	Exploit Issue Tracking Patch Third Party Advisory
7	https://github.com/ImageMagick/ImageMagick6/commit/bfa3b9610c83227894c92b0d312ad327fceb6241	Patch
8	https://github.com/ImageMagick/ImageMagick6/commit/bfa3b9610c83227894c92b0d312ad327fceb6241	Patch
9	https://lists.debian.org/debian-lts-announce/2019/08/msg00021.html	Mailing List Third Party Advisory
10	https://lists.debian.org/debian-lts-announce/2019/08/msg00021.html	Mailing List Third Party Advisory
11	https://usn.ubuntu.com/4192-1/	Third Party Advisory
12	https://usn.ubuntu.com/4192-1/	Third Party Advisory
13	https://www.debian.org/security/2020/dsa-4712	Third Party Advisory
14	https://www.debian.org/security/2020/dsa-4712	Third Party Advisory
15	https://www.debian.org/security/2020/dsa-4715	Third Party Advisory
16	https://www.debian.org/security/2020/dsa-4715	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

ImageMagick におけるバッファエラーの脆弱性

Title	ImageMagick におけるバッファエラーの脆弱性
Summary	ImageMagick には、バッファエラーの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 22, 2019, midnight
Registration Date	July 9, 2019, 12:30 p.m.
Last Update	July 9, 2019, 12:30 p.m.

Affected System

ImageMagick

ImageMagick 7.0.8-50 Q16

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-13304	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13304
National Vulnerability Database (NVD)
2	CVE-2019-13304	https://nvd.nist.gov/vuln/detail/CVE-2019-13304

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
GitHub
1	https://github.com//issues/1614	https://github.com/ImageMagick/ImageMagick/commit/7689875ef64f34141e7292f6945efdf0530b4a5e
2	https://github.com/ImageMagick/ImageMagick/issues/1614	https://github.com/ImageMagick/ImageMagick6/commit/bfa3b9610c83227894c92b0d312ad327fceb6241
3	stack-buffer-overflow at coders/pnm.c:1762 in WritePNMImage #1614	https://github.com/ImageMagick/ImageMagick/issues/1614

Change Log

No	Changed Details	Date of change
1	[2019年07月09日] 掲載	July 9, 2019, 12:30 p.m.