CVE-2019-11005: graphicsmagick Out-of-bounds Write
Vulnerability summary
CVE-2019-11005 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in graphicsmagick. EPSS estimates a 3.53% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 08-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.53%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.53% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sourceforge.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- graphicsmagick< 1.4~hg15968-1
Graphicsmagick1 product
- graphicsmagick≤ 1.3.31
Opensuse1 product
- leapEOL15.0 | 42.3
Ubuntu1 product
- graphicsmagick< 1.3.28-2ubuntu0.1
4 vendors · 4 products
References
10 links- lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
