Medium
Security advisory
The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-15139
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:20 UTC · Revision 1
Source evidence
The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.
osv:CVE-2019-15139
Complete source record
{
"id": "d8a5cfdaf475560d685fe2b0c315045755ea7de70bd809e3ed790f80e5d83c34",
"url": "https://osv.dev/vulnerability/CVE-2019-15139",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-15139",
"summary": "The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.",
"evidence": "osv:CVE-2019-15139",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-15139",
"aliases": [
"CVE-2019-15139"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/imagemagick/imagemagick",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c78993d138bf480ab4652b5a48379d4ff75ba5f7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "c78993d138bf480ab4652b5a48379d4ff75ba5f7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.0.8-40",
"7.0.8-39",
"7.0.8-38",
"7.0.8-37",
"7.0.8-36",
"7.0.8-35",
"7.0.8-34",
"7.0.8-33",
"7.0.8-32",
"7.0.8-31",
"7.0.8-30",
"7.0.8-29",
"7.0.8-28",
"7.0.8-27",
"7.0.8-26",
"7.0.8-25",
"7.0.8-24",
"7.0.8-23",
"7.0.8-22",
"7.0.8-21",
"7.0.8-20",
"7.0.8-19",
"7.0.8-18",
"7.0.8-17",
"7.0.8-16",
"7.0.8-15",
"7.0.8-14",
"7.0.8-13",
"7.0.8-12",
"7.0.8-11",
"7.0.8-10",
"7.0.8-9",
"7.0.8-8",
"7.0.8-7",
"7.0.8-6",
"7.0.8-5",
"7.0.8-4",
"7.0.8-3",
"7.0.8-2",
"7.0.8-1",
"7.0.8-0",
"7.0.7-39",
"7.0.7-38",
"7.0.7-37",
"7.0.7-36",
"7.0.7-35",
"7.0.7-34",
"7.0.7-33",
"7.0.7-32",
"7.0.7-31",
"7.0.7-30",
"7.0.7-29",
"7.0.7-28",
"7.0.7-27",
"7.0.7-26",
"7.0.7-25",
"7.0.7-24",
"7.0.7-23",
"7.0.7-22",
"7.0.7-21",
"7.0.7-20",
"7.0.7-19",
"7.0.7-18",
"7.0.7-17",
"7.0.7-16",
"7.0.7-15",
"7.0.7-14",
"7.0.7-13",
"7.0.7-12",
"7.0.7-11",
"7.0.7-10",
"7.0.7-9",
"7.0.7-8",
"7.0.7.7",
"7.0.7-6",
"7.0.7-5",
"7.0.7-4",
"7.0.7-3",
"7.0.7-2",
"7.0.7-1",
"7.0.7-0",
"7.0.6-9",
"7.0.6-8",
"7.0.6-7",
"7.0.6-6",
"7.0.6-5",
"7.0.6-4",
"7.0.6-3",
"7.0.6-2",
"7.0.6-1",
"7.0.6-0",
"7.0.5-10",
"7.0.5-9",
"7.0.5-8",
"7.0.5-7",
"7.0.5-6",
"7.0.5-5",
"7.0.5-4",
"7.0.5-3",
"7.0.5-2",
"7.0.5-1",
"7.0.5-0",
"7.0.4-10",
"7.0.4-9",
"7.0.4-8",
"7.0.4-7",
"7.0.4-6",
"7.0.4-5",
"7.0.4-4",
"7.0.4-3",
"7.0.4-2",
"7.0.4-1",
"7.0.4-0",
"7.0.3-10",
"7.0.3-9",
"7.0.3-8",
"7.0.3-7",
"7.0.3-6",
"7.0.3-5",
"7.0.3-4",
"7.0.3-3",
"7.0.3-2",
"7.0.3-1",
"7.0.3-0",
"7.0.2-10",
"7.0.2-9",
"7.0.2-8",
"7.0.2-7",
"7.0.2-6",
"7.0.2-5",
"7.0.2-4",
"7.0.2-3",
"7.0.2-2",
"7.0.2-1",
"7.0.2-0",
"7.0.1-10",
"7.0.1-9",
"7.0.1-8",
"7.0.1-7",
"7.0.1-6",
"7.0.1-5",
"7.0.1-4",
"7.0.1-3",
"7.0.1-2",
"7.0.1-1",
"7.0.1-0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15139.json",
"vanir_signatures": [
{
"id": "CVE-2019-15139-062c3f2a",
"digest": {
"length": 11896,
"function_hash": "222523409588967805881205251883555059641"
},
"source": "https://github.com/imagemagick/imagemagick/commit/c78993d138bf480ab4652b5a48379d4ff75ba5f7",
"target": {
"file": "coders/xwd.c",
"function": "ReadXWDImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15139-49ce9bbf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77250433361645637761914945101371172136",
"59001916702383334816419430731406999237",
"300125938841649958279419971072696657493",
"280632839186149021906732628782644439229",
"173236611228049478420825765237346765140",
"9666984930037304041841261070368930014",
"271585633245753474709474383371133701399",
"305958586116299563566600741573942111812",
"136329800113132017490645575324161610222",
"254243123892407683108105073353840512581",
"301057152321981097762248331498129794098",
"107750272021112340510587198380780612765",
"322087885619928533906442675761007969933",
"182006839467536575998326811461060023121",
"155704688215563833962350468490758749228",
"323541837437218636312778743919295079702",
"197049509744532814728158555490031482069",
"180294303944955519743280186190228626932",
"19439081871914515141813256390773926633",
"313109620294031691400553187404646047085",
"172842290547027961402164289346175391408",
"282285582299422391339525712233083842713"
]
},
"source": "https://github.com/imagemagick/imagemagick/commit/c78993d138bf480ab4652b5a48379d4ff75ba5f7",
"target": {
"file": "coders/xwd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15139-60d5e044",
"digest": {
"length": 391,
"function_hash": "28749667842553591282722470908780254171"
},
"source": "https://github.com/imagemagick/imagemagick/commit/c78993d138bf480ab4652b5a48379d4ff75ba5f7",
"target": {
"file": "coders/xwd.c",
"function": "RegisterXWDImage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:13:08Z"
}
}
],
"modified": "2026-10-24T14:13:08.113184508Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2019/10/msg00028.html",
"https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3IYH7QSNXXOIDFTYLY455ANZ3JWQ7FCS/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FS76VNCFL3FVRMGXQEMHBOKA7EE46BTS/",
"https://usn.ubuntu.com/4192-1/",
"https://www.debian.org/security/2020/dsa-4712",
"https://github.com/ImageMagick/ImageMagick/commit/c78993d138bf480ab4652b5a48379d4ff75ba5f7",
"https://github.com/ImageMagick/ImageMagick/issues/1553"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:imagemagick:imagemagick:7.0.8-41:q16:*:*:*:*:*:*"
],
"vendor_product": "imagemagick:imagemagick",
"extracted_events": [
{
"range": [
{
"introduced": "7.0.8-41-q16"
},
{
"last_affected": "7.0.8-41-q16"
},
{
"introduced": "7.0.8-41-q16"
},
{
"last_affected": "7.0.8-41-q16"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-15139",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443418,
"published_at": "2019-08-18T19:15:09.637+00:00"
}