CVE-2019-11470

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-26 Q16

Description The issue is related to the Cineon parsing component, which allows attackers to cause a denial-of-service due to uncontrolled resource consumption. This can be achieved by creating a Cineon image with an incorrect claimed image size. The problem stems from the ReadCINImage function in coders/cin.c, which lacks sufficient checks for image data in a file. An attacker can exploit this by crafting a Cineon image that exceeds the standard size, leading to a denial-of-service.

Recommendations For ImageMagick version 7.0.8-26 Q16, consider disabling the ReadCINImage function as a temporary workaround until a patch is available. Restrict access to the Cineon parsing component to minimize the risk of exploitation. Avoid using the Cineon image format until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.