CVE Vulnerabilities

CVE-2019-12974

NULL Pointer Dereference

Published: Jun 26, 2019 | Modified: Aug 19, 2020
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Imagemagick Imagemagick 7.0.8-34 (including) 7.0.8-34 (including)
Red Hat Enterprise Linux 7 RedHat autotrace-0:0.31.1-38.el7 *
Red Hat Enterprise Linux 7 RedHat emacs-1:24.3-23.el7 *
Red Hat Enterprise Linux 7 RedHat ImageMagick-0:6.9.10.68-3.el7 *
Red Hat Enterprise Linux 7 RedHat inkscape-0:0.92.2-3.el7 *
Imagemagick Ubuntu bionic *
Imagemagick Ubuntu cosmic *
Imagemagick Ubuntu devel *
Imagemagick Ubuntu disco *
Imagemagick Ubuntu eoan *
Imagemagick Ubuntu focal *
Imagemagick Ubuntu jammy *
Imagemagick Ubuntu kinetic *
Imagemagick Ubuntu lunar *
Imagemagick Ubuntu mantic *
Imagemagick Ubuntu noble *
Imagemagick Ubuntu oracular *
Imagemagick Ubuntu trusty *
Imagemagick Ubuntu trusty/esm *
Imagemagick Ubuntu xenial *

Potential Mitigations

References