NVD Vulnerability Detail

CVE-2019-14980

Summary	In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
Publication Date	Aug. 13, 2019, 8:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:27 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick::::::::	6.0			6.9.10-42
cpe:2.3:a:imagemagick:imagemagick::::::::	7.0.0-0			7.0.8-42

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html	Mailing List Third Party Advisory
5	https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba	Patch
6	https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba	Patch
7	https://github.com/ImageMagick/ImageMagick/compare/7.0.8-41...7.0.8-42	Patch
8	https://github.com/ImageMagick/ImageMagick/compare/7.0.8-41...7.0.8-42	Patch
9	https://github.com/ImageMagick/ImageMagick6/commit/614a257295bdcdeda347086761062ac7658b6830	Patch
10	https://github.com/ImageMagick/ImageMagick6/commit/614a257295bdcdeda347086761062ac7658b6830	Patch
11	https://github.com/ImageMagick/ImageMagick6/issues/43	Issue Tracking Third Party Advisory
12	https://github.com/ImageMagick/ImageMagick6/issues/43	Issue Tracking Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-416	解放済みメモリの使用	https://cwe.mitre.org/data/definitions/416.html

JVN Vulnerability Information

ImageMagick における解放済みメモリの使用に関する脆弱性

Title	ImageMagick における解放済みメモリの使用に関する脆弱性
Summary	ImageMagick には、解放済みメモリの使用に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 22, 2019, midnight
Registration Date	Aug. 19, 2019, 6:14 p.m.
Last Update	Aug. 19, 2019, 6:14 p.m.

Affected System

ImageMagick

ImageMagick 6.9.10-42 未満の 6.x

ImageMagick 7.0.8-42 未満の 7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-14980	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14980
National Vulnerability Database (NVD)
2	CVE-2019-14980	https://nvd.nist.gov/vuln/detail/CVE-2019-14980

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-416	https://cwe.mitre.org/data/definitions/416.html

ベンダー情報

No	Name	URL
GitHub
1	Comparing changes	https://github.com/ImageMagick/ImageMagick/compare/7.0.8-41...7.0.8-42
2	https://github.com//issues/43	https://github.com/ImageMagick/ImageMagick6/commit/614a257295bdcdeda347086761062ac7658b6830
3	https://github.com/ImageMagick/ImageMagick6/issues/43	https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba
4	Use after free in magick/blob.c #43	https://github.com/ImageMagick/ImageMagick6/issues/43

Change Log

No	Changed Details	Date of change
1	[2019年08月19日] 掲載	Aug. 19, 2019, 6:14 p.m.