CVE-2019-12979

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-34

Description The issue is related to the use of an uninitialized value in the SyncImageSettings function in MagickCore/image.c, which is also connected to AcquireImage in magick/image.c. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For ImageMagick version 7.0.8-34, consider disabling the SyncImageSettings function as a temporary workaround until a patch is available. Restrict access to the MagickCore/image.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.