CVE-2019-16713

Vulnerability

ImageMagick 7.0.8-43 contains a memory leak in the ReadDOTImage function within coders/dot.c. The leak is triggered when processing a specially crafted DOT image file, as demonstrated by the PingImage function in MagickCore/constitute.c [2]. The stack trace shows that memory allocated via AcquireImage at line 129 of coders/dot.c is not freed, resulting in a direct leak of 13,504 bytes per invocation [2]. The issue affects ImageMagick version 7.0.8-43 and possibly earlier versions.

Exploitation

An attacker can exploit this vulnerability by providing a malicious DOT image file to any ImageMagick tool that processes images, such as magick identify. No authentication or special privileges are required; the attack relies on user interaction (e.g., tricking a user into opening the file with an ImageMagick utility). Repeated processing of the crafted file causes the memory leak to accumulate, eventually exhausting system memory [2].

Impact

Successful exploitation results in memory exhaustion, leading to a denial of service condition. The Ubuntu security advisory [1] notes that other ImageMagick vulnerabilities may allow code execution, but this specific CVE is limited to a memory leak; no code execution or privilege escalation has been demonstrated for this issue.

Mitigation

The memory leak is fixed in ImageMagick versions after 7.0.8-43. Ubuntu released updated packages in USN-4192-1 [1] for Ubuntu 19.10 and other supported releases. Users should update to the latest ImageMagick package version. No workaround is available other than avoiding the processing of untrusted DOT files.