Vulnerabilities > CVE-2019-10649 - Memory Leak vulnerability in multiple products

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
local
low complexity
imagemagick
debian
canonical
CWE-401
nessus

Summary

In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_183D700EEC70487EA9C4632324AFA934.NASL
    descriptioncvedetails.com reports : CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c. CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c. CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file. CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file. CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV. CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file. CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
    last seen2020-06-01
    modified2020-06-02
    plugin id125614
    published2019-05-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125614
    titleFreeBSD : ImageMagick -- multiple vulnerabilities (183d700e-ec70-487e-a9c4-632324afa934)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2020 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(125614);
      script_version("1.5");
      script_cvs_date("Date: 2020/01/13");
    
      script_cve_id("CVE-2019-10131", "CVE-2019-10649", "CVE-2019-10650", "CVE-2019-10714", "CVE-2019-11470", "CVE-2019-11472", "CVE-2019-11597", "CVE-2019-11598", "CVE-2019-7175", "CVE-2019-7395", "CVE-2019-7396", "CVE-2019-7397", "CVE-2019-7398", "CVE-2019-9956");
    
      script_name(english:"FreeBSD : ImageMagick -- multiple vulnerabilities (183d700e-ec70-487e-a9c4-632324afa934)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "cvedetails.com reports :
    
    CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist
    in DecodeImage in coders/pcd.c.
    
    CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in
    WritePSDChannel in coders/psd.c.
    
    CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in
    ReadSIXELImage in coders/sixel.c.
    
    CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick
    through 1.3.31, several memory leaks exist in WritePDFImage in
    coders/pdf.c.
    
    CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in
    WriteDIBImage in coders/dib.c.
    
    CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based
    buffer overflow in the function PopHexPixel of coders/ps.c, which
    allows an attacker to cause a denial of service or code execution via
    a crafted image file.
    
    CVE-2019-10131: An off-by-one read vulnerability was discovered in
    ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer
    function in coders/meta.c. A local attacker may use this flaw to read
    beyond the end of the buffer or to crash the program.
    
    CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in
    the function SVGKeyValuePairs of coders/svg.c, which allows an
    attacker to cause a denial of service via a crafted image file.
    
    CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based
    buffer over-read in the function WriteTIFFImage of coders/tiff.c,
    which allows an attacker to cause a denial of service or information
    disclosure via a crafted image file.
    
    CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick
    before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
    
    CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26
    Q16 allows attackers to cause a denial-of-service (uncontrolled
    resource consumption) by crafting a Cineon image with an incorrect
    claimed image size. This occurs because ReadCINImage in coders/cin.c
    lacks a check for insufficient image data in a file.
    
    CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing
    component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a
    denial-of-service (divide-by-zero error) by crafting an XWD image file
    in which the header indicates neither LSB first nor MSB first.
    
    CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based
    buffer over-read in the function WriteTIFFImage of coders/tiff.c,
    which allows an attacker to cause a denial of service or possibly
    information disclosure via a crafted image file.
    
    CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based
    buffer over-read in the function WritePNMImage of coders/pnm.c, which
    allows an attacker to cause a denial of service or possibly
    information disclosure via a crafted image file. This is related to
    SetGrayscaleImage in MagickCore/quantize.c."
      );
      # https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?1f4e659e"
      );
      # https://vuxml.freebsd.org/freebsd/183d700e-ec70-487e-a9c4-632324afa934.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?df154b9c"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9956");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick6-nox11");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick7");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick7-nox11");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/05/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick7<7.0.8.47")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick7-nox11<7.0.8.47")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick6<6.9.10.47,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick6-nox11<6.9.10.47,1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idIMAGEMAGICK_7_0_8-44.NASL
    descriptionThe version of ImageMagick installed on the remote Windows host is 7.x prior to 7.0.8-44. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists due to a failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this by convincing a user into converting a specially crafted file, to cause the system to stop responding. (CVE-2018-15607) - A stack-based buffer overflow condition exists in the PopHexPixel function due to a failure to handle exceptional conditions. An unauthenticated,remote attacker can exploit this, via convincing a user to open a crafted image file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-9956) - A memory leak vulnerability exists in the SVGKeyValuePairs function due to a failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this via convincing a user to open a crafted image file, to cause the application to stop responding. (CVE-2019-10649) Note that the application may also be affected by additional vulnerabilities. Refer to the vendor for additional information.
    last seen2020-06-01
    modified2020-06-02
    plugin id124776
    published2019-05-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124776
    titleImageMagick < 7.0.8-44 Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(124776);
      script_version("1.4");
      script_cvs_date("Date: 2019/10/30 13:24:47");
    
      script_cve_id(
        "CVE-2018-15607",
        "CVE-2019-9956",
        "CVE-2019-10649",
        "CVE-2019-10650",
        "CVE-2019-11597",
        "CVE-2019-11598"
      );
      script_bugtraq_id(
        105137,
        107546,
        107645,
        107646,
        108102
      );
    
      script_name(english:"ImageMagick < 7.0.8-44 Multiple vulnerabilities");
      script_summary(english:"Checks the version of ImageMagick.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote Windows host is affected by multiple vulnerability");
      script_set_attribute(attribute:"description", value:
    "The version of ImageMagick installed on the remote Windows host is
    7.x prior to 7.0.8-44. It is, therefore, affected by multiple
    vulnerabilities:
    
      - A denial of service vulnerability exists due to a
        failure to handle exceptional conditions. An unauthenticated,
        remote attacker can exploit this by convincing a user into
        converting a specially crafted file, to cause the system
        to stop responding. (CVE-2018-15607)
    
      - A stack-based buffer overflow condition exists in the
        PopHexPixel function due to a failure to handle exceptional
        conditions. An unauthenticated,remote attacker can exploit
        this, via convincing a user to open a crafted image file,
        to cause a denial of service condition or the execution of
        arbitrary code. (CVE-2019-9956)
    
      - A memory leak vulnerability exists in the
        SVGKeyValuePairs function due to a failure to handle
        exceptional conditions. An unauthenticated, remote attacker
        can exploit this via convincing a user to open a crafted
        image file, to cause the application to stop responding.
        (CVE-2019-10649)
    
    Note that the application may also be affected by additional
    vulnerabilities. Refer to the vendor for additional information.
    ");
      # https://www.cvedetails.com/cve/CVE-2018-15607
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b866ca80");
      # https://www.cvedetails.com/cve/CVE-2019-9956
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?46745bf3");
      # https://www.cvedetails.com/cve/CVE-2019-10649
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9ef3902f");
      # https://www.cvedetails.com/cve/CVE-2019-10650
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76a32d69");
      # https://www.cvedetails.com/cve/CVE-2019-11597
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?614bf163");
      # https://www.cvedetails.com/cve/CVE-2019-11598
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3fffdd92");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to ImageMagick version 7.0.8-44 or later. Note that you may
    also need to manually uninstall the vulnerable version from the system.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9956");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/10");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:imagemagick:imagemagick");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("imagemagick_installed.nasl");
      script_require_keys("installed_sw/ImageMagick");
    
      exit(0);
    }
    
    include('vcf.inc');
    include('vcf_extras.inc');
    
    vcf::imagemagick::initialize();
    app_info = vcf::imagemagick::get_app_info();
    
    constraints = [{'fixed_version' : '7.0.8-44'}];
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4034-1.NASL
    descriptionIt was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick safely, the update for Ubuntu 18.10 and Ubuntu 19.04 includes a default policy change that disables support for the Postscript and PDF formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick policy configuration. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126254
    published2019-06-26
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126254
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : imagemagick vulnerabilities (USN-4034-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-4034-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(126254);
      script_version("1.4");
      script_cvs_date("Date: 2020/01/10");
    
      script_cve_id("CVE-2017-12805", "CVE-2017-12806", "CVE-2018-14434", "CVE-2018-15607", "CVE-2018-16323", "CVE-2018-16412", "CVE-2018-16413", "CVE-2018-16644", "CVE-2018-16645", "CVE-2018-17965", "CVE-2018-17966", "CVE-2018-18016", "CVE-2018-18023", "CVE-2018-18024", "CVE-2018-18025", "CVE-2018-18544", "CVE-2018-20467", "CVE-2019-10131", "CVE-2019-10649", "CVE-2019-10650", "CVE-2019-11470", "CVE-2019-11472", "CVE-2019-11597", "CVE-2019-11598", "CVE-2019-7175", "CVE-2019-7395", "CVE-2019-7396", "CVE-2019-7397", "CVE-2019-7398", "CVE-2019-9956");
      script_xref(name:"USN", value:"4034-1");
    
      script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : imagemagick vulnerabilities (USN-4034-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that ImageMagick incorrectly handled certain
    malformed image files. If a user or automated system using ImageMagick
    were tricked into opening a specially crafted image, an attacker could
    exploit this to cause a denial of service or possibly execute code
    with the privileges of the user invoking the program.
    
    Due to a large number of issues discovered in GhostScript that prevent
    it from being used by ImageMagick safely, the update for Ubuntu 18.10
    and Ubuntu 19.04 includes a default policy change that disables
    support for the Postscript and PDF formats in ImageMagick. This policy
    can be overridden if necessary by using an alternate ImageMagick
    policy configuration.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/4034-1/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9956");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:imagemagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:imagemagick-6.q16");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagick++-6.q16-5v5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagick++-6.q16-7");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagick++-6.q16-8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-2-extra");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-3-extra");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libmagickcore-6.q16-6-extra");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/06/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(16\.04|18\.04|18\.10|19\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04 / 18.04 / 18.10 / 19.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"16.04", pkgname:"imagemagick", pkgver:"8:6.8.9.9-7ubuntu5.14")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"imagemagick-6.q16", pkgver:"8:6.8.9.9-7ubuntu5.14")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"libmagick++-6.q16-5v5", pkgver:"8:6.8.9.9-7ubuntu5.14")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"libmagickcore-6.q16-2", pkgver:"8:6.8.9.9-7ubuntu5.14")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"libmagickcore-6.q16-2-extra", pkgver:"8:6.8.9.9-7ubuntu5.14")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"imagemagick", pkgver:"8:6.9.7.4+dfsg-16ubuntu6.7")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"imagemagick-6.q16", pkgver:"8:6.9.7.4+dfsg-16ubuntu6.7")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"libmagick++-6.q16-7", pkgver:"8:6.9.7.4+dfsg-16ubuntu6.7")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"libmagickcore-6.q16-3", pkgver:"8:6.9.7.4+dfsg-16ubuntu6.7")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"libmagickcore-6.q16-3-extra", pkgver:"8:6.9.7.4+dfsg-16ubuntu6.7")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"imagemagick", pkgver:"8:6.9.10.8+dfsg-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"imagemagick-6.q16", pkgver:"8:6.9.10.8+dfsg-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"libmagick++-6.q16-8", pkgver:"8:6.9.10.8+dfsg-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"libmagickcore-6.q16-6", pkgver:"8:6.9.10.8+dfsg-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"libmagickcore-6.q16-6-extra", pkgver:"8:6.9.10.8+dfsg-1ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"imagemagick", pkgver:"8:6.9.10.14+dfsg-7ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"imagemagick-6.q16", pkgver:"8:6.9.10.14+dfsg-7ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"libmagick++-6.q16-8", pkgver:"8:6.9.10.14+dfsg-7ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"libmagickcore-6.q16-6", pkgver:"8:6.9.10.14+dfsg-7ubuntu2.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"libmagickcore-6.q16-6-extra", pkgver:"8:6.9.10.14+dfsg-7ubuntu2.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "imagemagick / imagemagick-6.q16 / libmagick++-6.q16-5v5 / etc");
    }