GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-5974-1
Vulnerability from osv_ubuntu
Published
2023-03-27 16:40
Modified
2026-06-29 10:53
Summary
graphicsmagick vulnerabilities
Details

It was discovered that GraphicsMagick was not properly performing bounds checks when processing TGA image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted TGA image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20184)

It was discovered that GraphicsMagick was not properly validating bits per pixel data when processing DIB image files. If a user or automated system were tricked into processing a specially crafted DIB image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20189)

It was discovered that GraphicsMagick was not properly processing bit-field mask values in BMP image files, which could result in the execution of an infinite loop. If a user or automated system were tricked into processing a specially crafted BMP image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-5685)

It was discovered that GraphicsMagick was not properly validating data used in arithmetic operations when processing MNG image files, which could result in a divide-by-zero error. If a user or automated system were tricked into processing a specially crafted MNG image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-9018)

It was discovered that GraphicsMagick was not properly performing bounds checks when processing MIFF image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MIFF image file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2019-11006)

It was discovered that GraphicsMagick did not properly magnify certain MNG image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MNG image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-12672)

It was discovered that GraphicsMagick was not properly performing bounds checks when parsing certain MIFF image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MIFF image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-1270)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-5685",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-9018",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-20184",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-20189",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-11006",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1270",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "graphicsmagick",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          },
          {
            "binary_name": "graphicsmagick-imagemagick-compat",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          },
          {
            "binary_name": "graphicsmagick-libmagick-dev-compat",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          },
          {
            "binary_name": "libgraphics-magick-perl",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          },
          {
            "binary_name": "libgraphicsmagick++3",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          },
          {
            "binary_name": "libgraphicsmagick3",
            "binary_version": "1.3.18-1ubuntu3.1+esm8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "graphicsmagick",
        "purl": "pkg:deb/ubuntu/graphicsmagick@1.3.18-1ubuntu3.1+esm8?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.18-1ubuntu3.1+esm8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.16-1.1ubuntu2",
        "1.3.16-1.1ubuntu3",
        "1.3.18-1ubuntu3",
        "1.3.18-1ubuntu3.1",
        "1.3.18-1ubuntu3.1+esm1",
        "1.3.18-1ubuntu3.1+esm2",
        "1.3.18-1ubuntu3.1+esm3",
        "1.3.18-1ubuntu3.1+esm4",
        "1.3.18-1ubuntu3.1+esm5",
        "1.3.18-1ubuntu3.1+esm6",
        "1.3.18-1ubuntu3.1+esm7"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-5685",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-9018",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-20184",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-20189",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-11006",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1270",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "graphicsmagick",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          },
          {
            "binary_name": "graphicsmagick-imagemagick-compat",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          },
          {
            "binary_name": "graphicsmagick-libmagick-dev-compat",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          },
          {
            "binary_name": "libgraphics-magick-perl",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          },
          {
            "binary_name": "libgraphicsmagick++-q16-12",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          },
          {
            "binary_name": "libgraphicsmagick-q16-3",
            "binary_version": "1.3.23-1ubuntu0.6+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "graphicsmagick",
        "purl": "pkg:deb/ubuntu/graphicsmagick@1.3.23-1ubuntu0.6+esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.23-1ubuntu0.6+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.21-3",
        "1.3.23-1",
        "1.3.23-1build1",
        "1.3.23-1ubuntu0.1",
        "1.3.23-1ubuntu0.1+esm1",
        "1.3.23-1ubuntu0.2",
        "1.3.23-1ubuntu0.3",
        "1.3.23-1ubuntu0.4",
        "1.3.23-1ubuntu0.5",
        "1.3.23-1ubuntu0.6",
        "1.3.23-1ubuntu0.6+esm1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-1270",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "graphicsmagick",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "graphicsmagick-imagemagick-compat",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "graphicsmagick-libmagick-dev-compat",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "libgraphics-magick-perl",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "libgraphicsmagick++-q16-12",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "libgraphicsmagick-q16-3",
            "binary_version": "1.3.28-2ubuntu0.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "graphicsmagick",
        "purl": "pkg:deb/ubuntu/graphicsmagick@1.3.28-2ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.28-2ubuntu0.2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.26-15",
        "1.3.26-16",
        "1.3.26-19",
        "1.3.27-1",
        "1.3.27-2",
        "1.3.27-3",
        "1.3.28-1",
        "1.3.28-2",
        "1.3.28-2ubuntu0.1",
        "1.3.28-2ubuntu0.1+esm1",
        "1.3.28-2ubuntu0.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-12672",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1270",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "graphicsmagick",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          },
          {
            "binary_name": "graphicsmagick-imagemagick-compat",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          },
          {
            "binary_name": "graphicsmagick-libmagick-dev-compat",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          },
          {
            "binary_name": "libgraphics-magick-perl",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          },
          {
            "binary_name": "libgraphicsmagick++-q16-12",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          },
          {
            "binary_name": "libgraphicsmagick-q16-3",
            "binary_version": "1.4+really1.3.35-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "graphicsmagick",
        "purl": "pkg:deb/ubuntu/graphicsmagick@1.4+really1.3.35-1ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4+really1.3.35-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4+really1.3.33+hg16115-1",
        "1.4+really1.3.33+hg16115-1build1",
        "1.4+really1.3.33+hg16117-1",
        "1.4+really1.3.34-1",
        "1.4+really1.3.34-2",
        "1.4+really1.3.34+hg16181-1",
        "1.4+really1.3.35-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing TGA image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted TGA image file, an attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20184)\n\nIt was discovered that GraphicsMagick was not properly validating bits per\npixel data when processing DIB image files. If a user or automated system\nwere tricked into processing a specially crafted DIB image file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2018-20189)\n\nIt was discovered that GraphicsMagick was not properly processing\nbit-field mask values in BMP image files, which could result in the\nexecution of an infinite loop. If a user or automated system were tricked\ninto processing a specially crafted BMP image file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-5685)\n\nIt was discovered that GraphicsMagick was not properly validating data\nused in arithmetic operations when processing MNG image files, which\ncould result in a divide-by-zero error. If a user or automated system were\ntricked into processing a specially crafted MNG image file, an attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-9018)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing MIFF image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted MIFF image file, an attacker could possibly use this\nissue to cause a denial of service or expose sensitive information. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2019-11006)\n\nIt was discovered that GraphicsMagick did not properly magnify certain\nMNG image files, which could lead to a heap buffer overflow. If a user or\nautomated system were tricked into processing a specially crafted MNG\nimage file, an attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected Ubuntu\n20.04 LTS. (CVE-2020-12672)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when parsing certain MIFF image files, which could lead to a heap\nbuffer overflow. If a user or automated system were tricked into\nprocessing a specially crafted MIFF image file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\n(CVE-2022-1270)\n",
  "id": "USN-5974-1",
  "modified": "2026-06-29T10:53:00Z",
  "published": "2023-03-27T16:40:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5974-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-5685"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-9018"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-20184"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-20189"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-11006"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-12672"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1270"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "graphicsmagick vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2018-5685",
    "UBUNTU-CVE-2018-9018",
    "UBUNTU-CVE-2018-20184",
    "UBUNTU-CVE-2018-20189",
    "UBUNTU-CVE-2019-11006",
    "UBUNTU-CVE-2020-12672",
    "UBUNTU-CVE-2022-1270"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.