Date: Fri, 30 Aug 2013 01:24:33 +0200 From: Bastien ROUCARIES <roucaries.bastien@...il.com> To: oss-security@...ts.openwall.com Subject: CVE request for imagemagick bug The gif handling code of imagemagick allow execution of arbitrary code due to a buffer overflow of one byte. Gif image format is made of different kind of data unit called block and these block may appear at anytime. The code actually do the equivalent of a=malloc(length+count) [line 1 of the patch] and a[length+count]='\0' for each comment block [line 11 of patch]. Because this code is executed for every comment block and that an attacker could put arbitrary block between each comment block, and finaly this attacker could smash memory particularly on architecture where malloc layout is predictable. Worst the bug could be exploited remotly throught php-magick or perlmagick. A special image leading to malloc space corruption and thus a dos is available. Imagemagick before version 6.7.8-8 are affected. See upstream bug report here: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921 First reported as a dos here: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248 Fixed by commit: http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c Analysis by myself
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.