CVE-2019-11470

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

You can configure a security policy that limits the disk resource usage when running ImageMagick. Edit /etc/ImageMagick/policy.xml with:

<policymap>
   ...
   <policy domain="resource" name="disk" value="1GiB"/>
   ...
</policymap>