Bug 1767828 (CVE-2019-15140)

Summary: CVE-2019-15140 ImageMagick: Use after free in ReadMATImage in coders/mat.c
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: andreas, fedora, huzaifas, jhorak, mike, pahan, rdieter
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: ImageMagick 6.9.10-43, ImageMagick 7.0.8-43, GraphicsMagick 1.3.31 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-31 22:35:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1767829, 1767830, 1770511    
Bug Blocks: 1767832    

Description Guilherme de Almeida Suckevicz 2019-11-01 13:45:14 UTC
coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.


Upstream commit:

Comment 1 Guilherme de Almeida Suckevicz 2019-11-01 13:45:37 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 1767830]
Affects: fedora-all [bug 1767829]

Comment 3 Huzaifa S. Sidhpurwala 2019-11-10 05:32:30 UTC
Note about GraphicsMagick:

This issue was fixed in GraphicsMagick via: http://hg.code.sf.net/p/graphicsmagick/code/rev/233618f8fe82
The fix is available in GraphicsMagick-1.3.31

Comment 7 errata-xmlrpc 2020-03-31 19:33:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1180 https://access.redhat.com/errata/RHSA-2020:1180

Comment 8 Product Security DevOps Team 2020-03-31 22:35:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):