CVE-2019-19949: Buffer Overflow
ImageMagick is vulnerable to a heap-based buffer overflow, caused by a flaw in the WritePNGImage function in coders/png.c. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Other sources
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magickpngwriterawprofile and LocaleNCompare.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19949?
CVE-2019-19949 has a high severity score due to the potential for remote code execution via a heap-based buffer overflow.
How can I fix CVE-2019-19949?
To fix CVE-2019-19949, update ImageMagick to version 6.9.10-43 or 7.0.8-43 or later.
Which software is affected by CVE-2019-19949?
CVE-2019-19949 affects ImageMagick versions up to 6.9.10-43 and 7.0.8-43, as well as specific versions of IBM Data Risk Manager.
What type of vulnerability is CVE-2019-19949?
CVE-2019-19949 is a heap-based buffer overflow vulnerability affecting the WritePNGImage function.
Can CVE-2019-19949 be exploited remotely?
Yes, CVE-2019-19949 can be exploited remotely by tricking a victim into opening a specially-crafted PNG file.