Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-14981: ImageMagick crashes when processing certain image files
CVE-2019-14981 · published 7 years ago
Summary
Old versions of ImageMagick can crash if sent a specially crafted image file. This can cause the program to stop working temporarily. Update to the latest version to prevent this from happening.
What to do
- Update canonical imagemagick to version 8:6.7.7.10-6ubuntu3.13+esm21.
- Update canonical imagemagick to version 8:6.8.9.9-7ubuntu5.15.
- Update canonical imagemagick to version 8:6.9.7.4+dfsg-16ubuntu6.8.
- Update canonical imagemagick to version 8:6.9.10.23+dfsg-2.1ubuntu9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | imagemagick |
< 8:6.7.7.10-6ubuntu3.13+esm21 Fix: upgrade to 8:6.7.7.10-6ubuntu3.13+esm21
|
| Ubuntu:16.04:LTS | canonical | imagemagick |
< 8:6.8.9.9-7ubuntu5.15 Fix: upgrade to 8:6.8.9.9-7ubuntu5.15
|
| Ubuntu:18.04:LTS | canonical | imagemagick |
< 8:6.9.7.4+dfsg-16ubuntu6.8 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.8
|
| Ubuntu:20.04:LTS | canonical | imagemagick |
< 8:6.9.10.23+dfsg-2.1ubuntu9 Fix: upgrade to 8:6.9.10.23+dfsg-2.1ubuntu9
|
| – | imagemagick | imagemagick |
>= 6.0, < 6.9.10-41 >= 7.0.0-0, < 7.0.8-41 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 9.0 10.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
16.04 18.04 19.04 19.10 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
| – | opensuse | leap |
15.0 15.1 cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
Original advisory text
In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a ...
In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
References
- https://ubuntu.com/security/CVE-2019-14981 Third Party Advisory
- https://ubuntu.com/security/notices/USN-4192-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8263-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-14981 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00028.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html Mailing List Third Party Advisory
- https://usn.ubuntu.com/4192-1/ Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html Mailing List Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/a77d8d97f5a7bced0468f0b08798c8... Patch Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/1552 Patch Third Party Advisory
- https://github.com/ImageMagick/ImageMagick6/commit/b522d2d857d2f75b659936b59b0da... Patch Third Party Advisory
- https://www.debian.org/security/2020/dsa-4712 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-369Divide By Zero
Timeline
Published12 Aug 2019
Updated30 Oct 2026
First seen2 Apr 2026
Track software like this
Free during beta