Cloudanix VulnDB

CVE-2018-20184

Medium · 6.5

CVSS

6.5

EPSS

2.3%

Published

Dec 17, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in an image processing tool can let a specially made picture file crash programs that try to handle it, potentially disrupting services that work with images.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap-based buffer overflow in WriteTGAImage when processing TGA images whose row or column counts exceed the format specification limits, resulting in memory corruption and denial of service.

Why it matters to the business

Service outages or crashes can occur when an application using GraphicsMagick processes untrusted or attacker-supplied TGA image files, increasing operational risk for image-heavy workflows.

How an attack unfolds

An attacker crafts a TGA image file with excessive rows or columns, then causes a target application to invoke GraphicsMagick's WriteTGAImage function on that file, triggering the overflow and crashing the process.

How to fix it

Upgrade GraphicsMagick to a version released after the 2018-12-09 snapshot that corrects the TGA dimension handling in tga.c; if immediate upgrade is not possible, disable TGA format support or add strict input validation before image processing.

How to confirm the fix worked

Confirm the installed GraphicsMagick version is newer than snapshot-20181209, test that crafted oversized TGA files no longer cause crashes, and review release notes or changelog entries for the tga.c fix.

Typical attack path

  1. Identify an application or service that uses GraphicsMagick to handle user-supplied images
  2. Create a TGA image file with row or column dimensions that violate the TGA specification limits
  3. Deliver the malicious file through any channel that triggers image processing (upload, conversion, thumbnail generation)
  4. Trigger the WriteTGAImage code path, causing heap corruption and denial of service

How to detect it

Search application and system logs for GraphicsMagick crashes or segmentation faults occurring during TGA image processing; monitor for repeated failures on image conversion or thumbnail endpoints.

What your security team should do

  • Prioritize upgrade of GraphicsMagick in all environments that accept untrusted images
  • Implement content-type and format whitelisting to block TGA files until patched
  • Add runtime monitoring for GraphicsMagick process crashes during image operations
  • Review downstream dependents and rebuild any packages that statically link the vulnerable library

The record

In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attackers to cause a denial of service via a crafted image file, because the number of rows or columns can exceed the pixel-dimension restrictions of the TGA specification.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 graphicsmagick 0 1.4~hg15873-1
Debian:12 graphicsmagick 0 1.4~hg15873-1
Debian:13 graphicsmagick 0 1.4~hg15873-1
Debian:8 graphicsmagick 0 1.3.20-3+deb8u5
Mageia:6 graphicsmagick 0 1.3.31-1.3.mga6
SUSE:Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick 0 1.2.5-78.78.1
SUSE:Package Hub 15 GraphicsMagick 0 1.3.29-bp150.2.12.1
SUSE:Studio Onsite 1.3 GraphicsMagick 0 1.2.5-78.78.1
Ubuntu:18.04:LTS graphicsmagick 0 1.3.28-2ubuntu0.1
Ubuntu:20.04:LTS graphicsmagick 0 1.4+really1.3.35-1ubuntu0.1
Ubuntu:Pro:14.04:LTS graphicsmagick 0 1.3.18-1ubuntu3.1+esm8
Ubuntu:Pro:16.04:LTS graphicsmagick 0 1.3.23-1ubuntu0.6+esm2
Ubuntu:Pro:18.04:LTS graphicsmagick 0 1.3.28-2ubuntu0.2+esm1

Related vulnerabilities