CVE-2019-15141

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-43 Q16

Description The issue allows attackers to cause a denial-of-service, resulting in an application crash due to a heap-based buffer over-read, via a crafted TIFF image file. This is related to functions in LibTIFF, specifically TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif dirwrite.c. The problem occurs because of an incomplete fix for a previous issue.

Recommendations For ImageMagick version 7.0.8-43 Q16, as a temporary workaround, consider disabling the WriteTIFFImage function in coders/tiff.c until a patch is available. Restrict access to crafted TIFF image files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.