In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4586-2 advisory.

    USN-4586-1 fixed vulnerabilities in PHP ImageMagick. This update provides the corresponding update for     Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4586-1 advisory.

    It was discovered that PHP ImageMagick extension didn't check the address used by an array. An attacker     could use this issue to cause PHP ImageMagick to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-38 (PECL Imagick: Arbitrary code execution)

    An out-of-bounds write vulnerability was discovered in the Imagick PHP       extension.
  Impact :

    A remote attacker, able to upload specially crafted images which will       get processed by Imagick, could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for php7-imagick fixes the following issues :

Upgrade to version 3.4.4 :

Added :

  - function Imagick::optimizeImageTransparency()

  - METRIC_STRUCTURAL_SIMILARITY_ERROR

  - METRIC_STRUCTURAL_DISSIMILARITY_ERROR

  - COMPRESSION_ZSTD - https://github.com/facebook/zstd

  - COMPRESSION_WEBP

  - CHANNEL_COMPOSITE_MASK

  - FILTER_CUBIC_SPLINE - 'Define the lobes with the -define     filter:lobes=(2,3,4) (reference     https://imagemagick.org/discourse-server/viewtopic.php?f     =2&t=32506).'

  - Imagick now explicitly conflicts with the Gmagick     extension.

Fixes :

  - Correct version check to make RemoveAlphaChannel and     FlattenAlphaChannel be available when using Imagick with     ImageMagick version 6.7.8-x

  - Bug 77128 - Imagick::setImageInterpolateMethod() not     available on Windows

  - Prevent memory leak when ImagickPixel::__construct     called after object instantiation.

  - Prevent segfault when ImagickPixel internal constructor     not called.

  - Imagick::setResourceLimit support for values larger than     2GB (2^31) on 32bit platforms.

  - Corrected memory overwrite in     Imagick::colorDecisionListImage()

  - Bug 77791 - ImagickKernel::fromMatrix() out of bounds     write. Fixes CVE-2019-11037, boo#1135418

The following functions have been deprecated :

  - ImagickDraw, matte

  - Imagick::averageimages

  - Imagick::colorfloodfillimage

  - Imagick::filter

  - Imagick::flattenimages

  - Imagick::getimageattribute

  - Imagick::getimagechannelextrema

  - Imagick::getimageclipmask

  - Imagick::getimageextrema

  - Imagick::getimageindex

  - Imagick::getimagematte

  - Imagick::getimagemattecolor

  - Imagick::getimagesize

  - Imagick::mapimage

  - Imagick::mattefloodfillimage

  - Imagick::medianfilterimage

  - Imagick::mosaicimages

  - Imagick::orderedposterizeimage

  - Imagick::paintfloodfillimage

  - Imagick::paintopaqueimage

  - Imagick::painttransparentimage

  - Imagick::radialblurimage

  - Imagick::recolorimage

  - Imagick::reducenoiseimage

  - Imagick::roundcornersimage

  - Imagick::roundcorners

  - Imagick::setimageattribute

  - Imagick::setimagebias

  - Imagick::setimageclipmask

  - Imagick::setimageindex

  - Imagick::setimagemattecolor

  - Imagick::setimagebiasquantum

  - Imagick::setimageopacity

  - Imagick::transformimage

An out-of-bounds write vulnerability was discovered in php-imagick, a PHP extension to create and modify images using the ImageMagick API, which could result in denial of service, or potentially the execution of arbitrary code.

In PHP imagick extension, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party. (CVE-2019-11037)

**Version 3.4.4**

  - The 3.4.4 release is intended to be the last release     (other than small bug fixes) that will support either     PHP 5.x, or ImageMagick 6.x. The next planned release     will be PHP > 7.0 and ImageMagick > 7.0 at least, if not     higher.

  - **Added:**

  - function Imagick::optimizeImageTransparency()

  - METRIC_STRUCTURAL_SIMILARITY_ERROR

  - METRIC_STRUCTURAL_DISSIMILARITY_ERROR

  - COMPRESSION_ZSTD - https://github.com/facebook/zstd

  - COMPRESSION_WEBP

  - CHANNEL_COMPOSITE_MASK

  - FILTER_CUBIC_SPLINE - 'Define the lobes with the -define     filter:lobes={2,3,4} (reference     https://imagemagick.org/discourse-server/viewtopic.php?f     =2&t=32506).'

  - Imagick now explicitly conflicts with the Gmagick     extension.

  - **Fixes:**

  - Correct version check to make RemoveAlphaChannel and     FlattenAlphaChannel be available when using Imagick with     ImageMagick version 6.7.8-x

  - Bug 77128 - Imagick::setImageInterpolateMethod() not     available on Windows

  - Prevent memory leak when ImagickPixel::__construct     called after object instantiation.

  - Prevent segfault when ImagickPixel internal constructor     not called.

  - Imagick::setResourceLimit support for values larger than     2GB (2^31) on 32bit platforms.

  - Corrected memory overwrite in     Imagick::colorDecisionListImage()

  - Bug 77791 - ImagickKernel::fromMatrix() out of bounds     write.

  - **Deprecated:**

  - The following functions have been deprecated :

  - ImagickDraw, matte

  - Imagick::averageimages

  - Imagick::colorfloodfillimage

  - Imagick::filter

  - Imagick::flattenimages

  - Imagick::getimageattribute

  - Imagick::getimagechannelextrema

  - Imagick::getimageclipmask

  - Imagick::getimageextrema

  - Imagick::getimageindex

  - Imagick::getimagematte

  - Imagick::getimagemattecolor

  - Imagick::getimagesize

  - Imagick::mapimage

  - Imagick::mattefloodfillimage

  - Imagick::medianfilterimage

  - Imagick::mosaicimages

  - Imagick::orderedposterizeimage

  - Imagick::paintfloodfillimage

  - Imagick::paintopaqueimage

  - Imagick::painttransparentimage

  - Imagick::radialblurimage

  - Imagick::recolorimage

  - Imagick::reducenoiseimage

  - Imagick::roundcornersimage

  - Imagick::roundcorners

  - Imagick::setimageattribute

  - Imagick::setimagebias

  - Imagick::setimageclipmask

  - Imagick::setimageindex

  - Imagick::setimagemattecolor

  - Imagick::setimagebiasquantum

  - Imagick::setimageopacity

  - Imagick::transformimage

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183552	Ubuntu 16.04 ESM : PHP ImageMagick vulnerability (USN-4586-2)	Nessus	Ubuntu Local Security Checks	critical
141542	Ubuntu 18.04 LTS : PHP ImageMagick vulnerability (USN-4586-1)	Nessus	Ubuntu Local Security Checks	critical
134724	GLSA-202003-38 : PECL Imagick: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
132905	openSUSE Security Update : php7-imagick (openSUSE-2020-14)	Nessus	SuSE Local Security Checks	critical
131294	Debian DSA-4576-1 : php-imagick - security update	Nessus	Debian Local Security Checks	critical
127065	Amazon Linux AMI : php54-pecl-imagick / php55-pecl-imagick,php56-pecl-imagick,php70-pecl-imagick,php71-pecl-imagick,php72-pecl-imagick (ALAS-2019-1237)	Nessus	Amazon Linux Local Security Checks	critical
125183	Fedora 28 : php-pecl-imagick (2019-9448fa46f3)	Nessus	Fedora Local Security Checks	critical
125181	Fedora 29 : php-pecl-imagick (2019-5dc1f4100e)	Nessus	Fedora Local Security Checks	critical
125180	Fedora 30 : php-pecl-imagick (2019-488d0f9a4b)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-11037

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical