CVE-2019-13299

Vulnerability

A heap-based buffer over-read vulnerability exists in ImageMagick 7.0.8-50 Q16 within the GetPixelChannel function defined in MagickCore/pixel-accessor.h at line 116. The issue occurs when the function accesses image->channel_map[channel].offset without first verifying that the channel's traits are not UndefinedPixelTrait. When processing a crafted command such as magick -seed 0 "(" magick:netscape -monochrome ")" "(" magick:netscape +repage ")" -geometry 433%-80-57 -adjoin -evaluate-sequence Median, an invalid offset can lead to reading beyond the allocated heap buffer. This affects all installations using the specified version [1].

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted image or command line to ImageMagick. No authentication or special privileges are required beyond the ability to execute the magick command with the malicious input. The proof-of-concept provided in the issue report demonstrates that simply running the command with the given parameters results in a heap-buffer-overflow, as shown by AddressSanitizer output. The attacker must have local access to the system or be able to deliver the crafted input to a service using ImageMagick [1].

Impact

Successful exploitation results in a heap-buffer-over-read, which may cause a denial of service (crash) or lead to information disclosure by exposing sensitive data from adjacent heap memory. The vulnerability is classified as a high-severity issue due to the potential for memory leakage. It does not allow for arbitrary write or code execution based on the available information [1][2].

Mitigation

The issue was fixed in commit 8187d2d8fd010d2d6b1a3a8edd935beec404dddc by adding a proper bounds check: image->channel_map[image->channel_map[channel].offset].traits is now verified before access [2]. Users should upgrade to a version of ImageMagick that includes this fix. As a workaround, avoid processing untrusted images with the affected version until an update can be applied.