CVE-2019-7395

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.htmlBroken Link
http://www.securityfocus.com/bid/106850Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/8a43abefb38c5e29138e1c9c515b313363541c06Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1451Exploit, Patch, Third Party Advisory
https://usn.ubuntu.com/4034-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4712Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.htmlBroken Link
http://www.securityfocus.com/bid/106850Third Party Advisory, VDB Entry
https://github.com/ImageMagick/ImageMagick/commit/8a43abefb38c5e29138e1c9c515b313363541c06Patch, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1451Exploit, Patch, Third Party Advisory
https://usn.ubuntu.com/4034-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4712Third Party Advisory

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-73967.5In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.CVE-2019-73977.5In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.CVE-2019-73987.5In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.CVE-2019-73997.4Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.CVE-2019-74006.1Rukovoditel before 2.4.1 allows XSS.CVE-2019-74019.8NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request CVE-2019-74026.1An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can CVE-2019-74034.9An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=imp CVE-2019-74047.5An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request c CVE-2019-74096.1Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or CVE-2019-74106.1There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $CVE-2019-74115.4Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject