CVE-2019-19949

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

This update for ImageMagick fixes the following issues:

Security issue fixed:

• CVE-2019-19948: Fixed a heap-based buffer overflow in WriteSGIImage() (bsc#1159861).
• CVE-2019-19949: Fixed a heap-based buffer over-read in WritePNGImage() (bsc#1160369).

Non-security issue fixed:

• Fixed an issue where converting tiff to png would lead to unviewable files (bsc#1161194).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the ImageMagick-7.1.0.9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ImageMagick fixes the following issues:

Security issue fixed:

• CVE-2019-19948: Fixed a heap-based buffer overflow in WriteSGIImage() (bsc#1159861).
• CVE-2019-19949: Fixed a heap-based buffer over-read in WritePNGImage() (bsc#1160369).

Non-security issue fixed:

• Fixed an issue where converting tiff to png would lead to unviewable files (bsc#1161194).

This update for ImageMagick fixes the following issues:

Security issue fixed:

• CVE-2019-19948: Fixed a heap-based buffer overflow in WriteSGIImage() (bsc#1159861).
• CVE-2019-19949: Fixed a heap-based buffer over-read in WritePNGImage() (bsc#1160369).

Non-security issue fixed:

• Fixed an issue where converting tiff to png would lead to unviewable files (bsc#1161194).

It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact. (CVE-2019-19948, CVE-2019-19949)

It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.10. (CVE-2019-19948, CVE-2019-19949)

It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-27560)

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or potentially leak sensitive information. These vulnerabilities included heap and stack-based buffer overflows, memory leaks, and improper handling of uninitialized values.