CVE-2019-11005

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54dVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/600/Exploit, Third Party Advisory
https://usn.ubuntu.com/4207-1/
https://www.debian.org/security/2020/dsa-4640
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54dVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/600/Exploit, Third Party Advisory
https://usn.ubuntu.com/4207-1/
https://www.debian.org/security/2020/dsa-4640

Timeline

Published: Apr 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-110069.1In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which all CVE-2019-110078.1In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allow CVE-2019-110088.8In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allow CVE-2019-110098.1In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allow CVE-2019-11016.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-110106.5In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to c CVE-2019-110119.8Akamai CloudTest before 58.30 allows remote code execution.CVE-2019-110136.5Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to trav CVE-2019-110149.8The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not CVE-2019-110156.8A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authenticat CVE-2019-110166.1Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.CVE-2019-110174.8On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.ht