CVE-2019-12978

Vulnerability

ImageMagick version 7.0.8-34 contains a use-of-uninitialized-value vulnerability in the ReadPANGOImage function in coders/pango.c [1]. The issue occurs when an image is acquired via AcquireImage and the SetImageBackgroundColor function is not called if image->columns or image->rows is zero, leaving pixel data uninitialized [1]. This code path is reachable when processing specially crafted images that trigger the PANGO decoder.

Exploitation

An attacker can exploit this vulnerability by providing a crafted image file to a victim using ImageMagick to process it. No authentication or special privileges are required beyond the ability to submit an image for processing. The vulnerability is triggered during image decoding when the PANGO code path is invoked and the image dimensions are zero, causing access to uninitialized memory.

Impact

Successful exploitation leads to undefined behavior due to reading uninitialized memory. This could result in denial of service (e.g., crash) or potential information disclosure if the uninitialized data is exposed. The severity depends on the context of the application using ImageMagick.

Mitigation

The vulnerability was addressed in later commits (e.g., 18df577 and f1fb781) [1]. Users should upgrade ImageMagick to a version after 7.0.8-34 that includes the fix. If upgrading is not immediately possible, avoid processing untrusted images with the PANGO decoder as a workaround.