CVE:CVE-2019-12921
CNNVD:CNNVD-202003-1127
GraphicsMagick是一套简单的图像处理工具。该工具对图像提供尺寸调整、旋转、加亮等功能。
GraphicsMagick 1.3.32之前版本中的text filename组件存在命令注入漏洞。远程攻击者可借助特制的图像利用该漏洞读取任意文件。
solution:Upgrade graphicsmagick graphicsmagick to a higher version than 1.3.32,and avoid the version (,1.3.32); Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0; Upgrade opensuse backports_sle to a higher version than 15.0:sp1,and avoid the version 15.0:sp1; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1