CVE-2019-16709

Vulnerability

ImageMagick version 7.0.8-35 contains a memory leak in coders/dps.c when using XCreateImage. The leak occurs due to improper memory deallocation when processing certain image files, as demonstrated in the referenced issue [2]. This affects the DPS (Display PostScript) coder, which is used to handle specific image formats.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious image file and convincing a user to process it with ImageMagick (e.g., using the convert command). The attack requires no authentication but does rely on user interaction. As shown in [2], running magick convert <crafted_file> output.x and then closing the ImageMagick windows triggers the memory leak, which can be repeated to exhaust system resources.

Impact

Successful exploitation leads to a memory leak, gradually consuming available memory. This can result in denial of service (DoS) by exhausting system resources, potentially causing the application or system to become unresponsive. No code execution or privilege escalation is reported for this specific issue.

Mitigation

Update ImageMagick to a version newer than 7.0.8-35. For Ubuntu systems, refer to the security advisory [1] which provides updated packages (e.g., for Ubuntu 19.10 eoan, update to the appropriate version). No workaround is available; applying the patch from the vendor is recommended.