oss-security - CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170116201621.h7ywb7fa6t72jcpc@eldamar.local>
Date: Mon, 16 Jan 2017 21:16:21 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: Bastien ROUCARIÈS <roucaries.bastien+debian@...il.com>
Subject: CVE Request: Imagemagick: various flaws: memory corruption,
 out-of-bounds writes, memory leaks, double-frees, off-by-one errors

Hi

The Debian package maintainer for ImageMagick reported several flaws
in the Debian bugtracker, which might warrant an identifier. It is
planned to fix those at least for the unstable distribution. I'm
listing those with the given references by Bastien. Please include him
in case of questions needed.

- coders/ipl.c: "ipl file missing malloc check"
Debian Bug: https://bugs.debian.org/851485
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/97566cf2806c0a5a86e884c96831a0c3b1ec6c20

- coders/wpg.c: off-by-one error
Debian Bug: https://bugs.debian.org/851483
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9

- magick/profile.c: double-free memory corruption
Debian Bug: https://bugs.debian.org/851383
Upstream Bug: https://github.com/ImageMagick/ImageMagick/issues/354
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6235f1f7a9f7b0f83b197f6cd0073dbb6602d0fb

- coders/mpc.c: memory leak in mpc file handling
Debian Bug: https://bugs.debian.org/851382
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/4493d9ca1124564da17f9b628ef9d0f1a6be9738

- PushQuantumPixel heap buffer-overflow
Debian Bug: https://bugs.debian.org/851381
Upstream report: https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31161

- memory leak in caption and label handling
Debian Bug: https://bugs.debian.org/851380
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/aeff00de228bc5a158c2a975ab47845d8a1db456

- coders/psd.c: out-of-bounds write flaw in psd file handling
Debian Bug: https://bugs.debian.org/851377
Upstream report: https://github.com/ImageMagick/ImageMagick/issues/350

- coders/psd.c: out-of-bounds write flaw in psd file handling
(different issue from the above)
Debian Bug: https://bugs.debian.org/851376
Upstream report: https://github.com/ImageMagick/ImageMagick/issues/348

- coders/psd.c: memory corruption heap overflow
Debian Bug: https://bugs.debian.org/851374
Upstream report: https://github.com/ImageMagick/ImageMagick/issues/347

Could you assign identifiers for those issues?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.