CVE-2019-13295

Vulnerability

ImageMagick 7.0.8-50 Q16 contains a heap-based buffer over-read vulnerability in AdaptiveThresholdImage at MagickCore/threshold.c. The issue occurs when a width of zero is passed to the function, which is not properly handled, leading to an out-of-bounds read. The vulnerability was discovered via the magick:logo and magick:wizard images with -lat 0x564-42% parameter [1].

Exploitation

An attacker can trigger the vulnerability by using a crafted command that passes a width of zero to the -lat (adaptive threshold) operator. For example: magick -seed 0 "(" magick:logo +repage ")" "(" magick:wizard -lat 0x564-42% ")" -quiet tmp. No authentication is required, as this is a command-line invocation that can be executed by any user with access to the magick binary. The exploit does not require any special network position or user interaction beyond running the provided command [1].

Impact

Successful exploitation results in a heap-based buffer over-read, which can lead to information disclosure (reading out-of-bounds heap memory). The vulnerability could potentially be leveraged to crash the application or leak sensitive data. The ASAN report confirms a read of size 4 from an invalid memory location, indicating potential for memory corruption [1].

Mitigation

The issue has been patched in both the ImageMagick 6 and ImageMagick 7 codebases. For ImageMagick 7, the fix is in commit a7759f410b773a1dd57b0e1fb28112e1cd8b97bc, which adds a check for width == 0 and returns an early clone of the image [3]. For ImageMagick 6, the equivalent fix is in commit 55e6dc49f1a381d9d511ee2f888fdc3e3c3e3953 [2]. Users should update to the latest patched version of ImageMagick. No workaround is mentioned if updating is not possible.