Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 02 Dec 2016 19:16:04 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556)

On Friday 02 December 2016 13:07:34 cve-assign@...re.org wrote:
> > https://blogs.gentoo.org/ago/2016/12/01/imagemagick-heap-based-buffer-over
> > flow-in-ispixelgray-pixel-accessor-h-incomplete-fix-for-cve-2016-9556
> > 
> > AddressSanitizer: heap-buffer-overflow
> > READ of size 4
> >
> >     #0 0x7f897b123266 in IsPixelGray
> >     ImageMagick-7.0.3-8/./MagickCore/pixel-accessor.h:507:30
> 
> Use CVE-2016-9773 for the vulnerability present in "an updated version
> which includes the fix for CVE-2016-9556."

The updated version which includes the fix for CVE-2016-9556 is 7.0.3.8 ( as 
stated under the affected version 'field'.

Anyway, upstream added a patch for this issue:
https://github.com/ImageMagick/ImageMagick/commit/4e8c2ed53fcb54a34b3a6185b2584f26cf6874a3

-- 
Agostino Sarubbo
Gentoo Linux Developer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.