ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.
[
{
"source": "https://github.com/imagemagick/imagemagick/commit/39f226a9c137f547e12afde972eeba7551124493",
"target": {
"file": "coders/jpeg.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2019-17541-3a4e27b9",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298464163442441046560032652436229974589",
"294493407928060086902090451494948848471",
"239558435851191139786243609252190313304",
"174941875620559024360031669407796873050",
"150909584492575075029120985079547939150",
"145253219722843083892472306779134767729",
"226910898925591040937906631650165997437",
"7240632240786876125718939989864297062",
"288773433012429611411115755426535310652",
"180284557788624703564401724692554828823",
"222224028087009726301451850433323280976"
]
}
},
{
"source": "https://github.com/imagemagick/imagemagick/commit/39f226a9c137f547e12afde972eeba7551124493",
"target": {
"function": "ReadICCProfile",
"file": "coders/jpeg.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2019-17541-ff26995d",
"signature_type": "Function",
"digest": {
"length": 1968.0,
"function_hash": "251887030472071515612237110508334716134"
}
}
]