CVE-2019-11010

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/a348d9661019Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00015.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/601/Patch, Third Party Advisory
https://usn.ubuntu.com/4207-1/
https://www.debian.org/security/2020/dsa-4640
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/a348d9661019Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00015.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/graphicsmagick/bugs/601/Patch, Third Party Advisory
https://usn.ubuntu.com/4207-1/
https://www.debian.org/security/2020/dsa-4640

Timeline

Published: Apr 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-110119.8Akamai CloudTest before 58.30 allows remote code execution.CVE-2019-110136.5Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to trav CVE-2019-110149.8The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not CVE-2019-110156.8A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authenticat CVE-2019-110166.1Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.CVE-2019-110174.8On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.ht CVE-2019-110189.8application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after CVE-2019-110197.5Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim detai CVE-2019-11028.8A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka CVE-2019-110207.5Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visi CVE-2019-110217.2admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While i CVE-2019-110238.8The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graph