CVE-2019-11506

Vulnerability

A heap-based buffer overflow vulnerability exists in GraphicsMagick's WriteMATLABImage function within coders/mat.c. Affected versions range from 1.3.30 up to and including the 1.4 snapshot-20190403 for the Q8 quantum depth. The overflow occurs in ExportRedQuantumType in magick/export.c when writing a MATLAB image file, as a result of insufficient bounds checking during pixel export operations [1].

Exploitation

An attacker can trigger the overflow by providing a specially crafted MAT image file and using the gm convert command to write it to a .mat output file [1]. No authentication or special privileges are required; the attacker only needs to trick the user into processing the malicious file. The proof-of-concept from the bug report demonstrates that the crash reproduces reliably with the command ./gm convert ./heap-buffer-overflow_WriteMATLABImage ./out.mat [1].

Impact

Successful exploitation causes a heap-buffer-overflow write of size 1, leading to a denial of service via process crash. The description notes the possibility of “unspecified other impact,” implying that under certain conditions the overflow may be leveraged for arbitrary code execution, though no such exploit is documented in the available references [1].

Mitigation

As of the publication date (2019-04-24), no patched version has been released; users should restrict processing of untrusted MAT image files or consider using alternative image processing libraries. The vulnerability is disclosed without a fix, and no workaround other than avoiding the affected functionality is provided [1].