CVE-2018-20185 — MEDIUM (5.3)

Vulnerability Description

In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Graphicsmagick	Graphicsmagick	1.4
Debian	Debian Linux	8.0
Canonical	Ubuntu Linux	18.04

Related Weaknesses (CWE)

CWE-125

References

http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e3977a293PatchVendor Advisory
http://www.securityfocus.com/bid/106229Third Party AdvisoryVDB Entry
https://lists.debian.org/debian-lts-announce/2018/12/msg00018.htmlMailing ListThird Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/582/ExploitThird Party Advisory
https://usn.ubuntu.com/4207-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4640Third Party Advisory
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e3977a293PatchVendor Advisory
http://www.securityfocus.com/bid/106229Third Party AdvisoryVDB Entry
https://lists.debian.org/debian-lts-announce/2018/12/msg00018.htmlMailing ListThird Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/582/ExploitThird Party Advisory
https://usn.ubuntu.com/4207-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4640Third Party Advisory

FAQ

What is CVE-2018-20185?

CVE-2018-20185 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a ...

How severe is CVE-2018-20185?

CVE-2018-20185 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-20185?

Check the references section above for vendor advisories and patch information. Affected products include: Graphicsmagick Graphicsmagick, Debian Debian Linux, Canonical Ubuntu Linux.