ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
BF97F7CB-3E80-4DBB-8854-FF5C012BA0FA
6.9.10-50
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
F8AB2B06-598F-4F38-813C-B1E3E1E7EEE5
7.0.8-50
7.0.0-0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
CD783B0C-9246-47D9-A937-6144FE8BFF0F
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
OR
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
35364557-83E3-4807-8D93-84BF17E01075
11.6.5.2
11.5.2
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
5D3F7911-FB00-4612-9109-9E7A407BC7B7
12.1.5.2
12.1.0
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
B547F46F-5563-4E7F-8B69-3D25C6C58521
13.1.3.4
13.1.0
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
1261AE74-41AF-4848-9AD9-46918C46845B
14.1.2.5
14.0.0
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
1549C41F-9467-42C6-AF4B-644900495590
15.0.1.3
15.0.0
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
45920B7E-10A6-4066-87AB-60D584689891
15.1.0.2
15.1.0
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
DC9ED27E-9096-4A7D-96A7-E3F47E747D73
11.6.5.2
11.5.2
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
02CB8916-A9ED-4935-BFBD-5C9E8D45379E
12.1.5.2
12.1.0
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
5853A161-2F92-4298-A70A-03A66DED157C
13.1.3.4
13.1.0
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
E0C65C13-C852-4A12-BFC0-A4DB201FFCAF
14.1.2.5
14.0.0
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
CDE4FB3F-887D-48FC-B5F7-E06FA8AAEF30
15.0.1.3
15.0.0
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
0064DE79-D6D6-4AE0-BF10-BF91FF9158DF
15.1.0.2
15.1.0
OR
### Prerequisites

- [ y ] I have written a descriptive issue title
- [ y ] I have verified that I am using the latest version of ImageMagick
- [ y ] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->


```
  /* ----- Load RLE compressed raster ----- */
  BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
    sizeof(*BImgBuff));  /*Ldblk was set in the check phase*/
  if(BImgBuff==NULL) goto NoMemory;

  offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
```
(https://github.com/ImageMagick/ImageMagick/blob/master/coders/cut.c#L552)

We should initialize the BImgBuff, otherwise an use-of-uninitialized vulnerability occurs, which is similar to https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6780 (fixed in https://github.com/ImageMagick/ImageMagick/commit/a85ab26099152be3dab0bd377670abfc815b9fe7 and https://github.com/ImageMagick/ImageMagick/commit/81bfff2759854654bf07e452bf3b9b329f3c55e5 ) and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5710 (fixed in https://github.com/ImageMagick/ImageMagick/commit/ce433f8048b120b2a0413b4ac3ef59fca35a9788 and https://github.com/ImageMagick/ImageMagick/commit/81bfff2759854654bf07e452bf3b9b329f3c55e5).


<!-- Thanks for reporting the issue to ImageMagick! -->

Use of uninitialized value in function ReadCUTImage
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : Use of uninitialized value in function ReadCUTImage
Issue date:

--- start body ---
### Prerequisites

- [ y ] I have written a descriptive issue title
- [ y ] I have verified that I am using the latest version of ImageMagick
- [ y ] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->


```
  /* ----- Load RLE compressed raster ----- */
  BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
    sizeof(*BImgBuff));  /*Ldblk was set in the check phase*/
  if(BImgBuff==NULL) goto NoMemory;

  offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
```
(https://github.com/ImageMagick/ImageMagick/blob/master/coders/cut.c#L552)

We should initialize the BImgBuff, otherwise an use-of-uninitialized vulnerability occurs, which is similar to https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6780 (fixed in https://github.com/ImageMagick/ImageMagick/commit/a85ab26099152be3dab0bd377670abfc815b9fe7 and https://github.com/ImageMagick/ImageMagick/commit/81bfff2759854654bf07e452bf3b9b329f3c55e5 ) and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5710 (fixed in https://github.com/ImageMagick/ImageMagick/commit/ce433f8048b120b2a0413b4ac3ef59fca35a9788 and https://github.com/ImageMagick/ImageMagick/commit/81bfff2759854654bf07e452bf3b9b329f3c55e5).


<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---