CVE-2019-13454: ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c

Medium severity · published Jul 9, 2019

CVE-2019-13454

ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c

6.5

CVSS

4.4%

EPSS

On KEV

Description

ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)4.4% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

9.0; 10.0 · source: NVD

Imagemagick · Imagemagick

7.0.1-0 through 7.0.8-54; 7.0.8-54 · source: NVD

Leap · Opensuse

15.0; 15.1 · source: NVD

Ubuntu Linux · Canonical

16.04; 18.04; 19.04; 19.10 · source: NVD

Affected product

Ubuntu Linux

Canonical

All Ubuntu Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-13454

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-13454

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html

Third Party Advisory

http://www.securityfocus.com/bid/109099

Product

https://github.com/ImageMagick/ImageMagick/blob/7.0.1-0/MagickCore/layer.c#L1618

Patch

https://github.com/ImageMagick/ImageMagick/commit/1ddcf2e4f28029a888cadef2e757509ef5047ad8

Exploit

https://github.com/ImageMagick/ImageMagick/issues/1629

Patch

https://github.com/ImageMagick/ImageMagick6/commit/4f31d78716ac94c85c244efcea368fea202e2ed4