CVE-2019-12921

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00049.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00051.htmlMailing List, Third Party Advisory
http://www.graphicsmagick.org/Product, Vendor Advisory
https://github.com/d0ge/data-processing/blob/master/CVE-2019-12921.mdThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00026.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2020/dsa-4675Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00049.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00051.htmlMailing List, Third Party Advisory
http://www.graphicsmagick.org/Product, Vendor Advisory
https://github.com/d0ge/data-processing/blob/master/CVE-2019-12921.mdThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00026.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2020/dsa-4675Third Party Advisory

Timeline

Published: Mar 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-129226.5A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.CVE-2019-129236.5In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly a CVE-2019-129249.8MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthentica CVE-2019-129258.1MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove,CVE-2019-129268.8MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perf CVE-2019-129276.1MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie di CVE-2019-129289.8The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve CVE-2019-129299.8The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, CVE-2019-12935.5An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in CVE-2019-129306.1A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows CVE-2019-129326.1A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in th CVE-2019-129348.8An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-j