CVE-2019-11474

moderate-risk
Published 2019-04-23

coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (floating-point exception and application crash) by crafting an XWD image file, a different vulnerability than CVE-2019-11008 and CVE-2019-11009.

Do I need to act?

~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (10)

Affected Vendors

Debian Canonical Graphicsmagick Fedoraproject Opensuse

References (24)

Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/5402c5cbd8bd
Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/944dcbc457f8
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html
Release Notes http://www.graphicsmagick.org/Changelog.html
Mailing List http://www.securityfocus.com/bid/108055
Mailing List https://lists.debian.org/debian-lts-announce/2019/05/msg00027.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://usn.ubuntu.com/4207-1/
Third Party Advisory https://www.debian.org/security/2020/dsa-4640
Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/5402c5cbd8bd
Patch http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/944dcbc457f8
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html
Release Notes http://www.graphicsmagick.org/Changelog.html
Mailing List http://www.securityfocus.com/bid/108055
Mailing List https://lists.debian.org/debian-lts-announce/2019/05/msg00027.html
and 4 more references
46
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 6/34 · Minimal
Exposure 16/34 · Moderate