USN-4670-1: ImageMagick vulnerabilities | Cloud Foundry

Severity

Low

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 18.04

Description

It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.10. (CVE-2019-19948, CVE-2019-19949)

It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-27560)

CVEs contained in this USN include: CVE-2019-19948, CVE-2019-19949, CVE-2020-27560.

Affected Cloud Foundry Products and Versions

Severity is low unless otherwise noted.

• cflinuxfs3
  • All versions prior to 0.216.0
• CF Deployment
  • All versions prior to 16.0.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs3
  • Upgrade All versions to 0.216.0 or greater
• CF Deployment
  • Upgrade All versions to 16.0.0 or greater

References

• USN Notice
• CVE-2019-19948
• CVE-2019-19949
• CVE-2020-27560

History

2021-02-10: Initial vulnerability report published.