Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Aug 2013 01:24:33 +0200
From: Bastien ROUCARIES <roucaries.bastien@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request for imagemagick bug

The gif handling code of imagemagick allow execution of arbitrary code
due to a buffer overflow of one byte.
Gif image format is made of different kind of data unit called block
and these block may appear at anytime.
The code actually do the equivalent of a=malloc(length+count) [line 1
of the patch] and  a[length+count]='\0' for each comment block [line
11 of patch].
Because this code is executed for every comment block and that an
attacker could put arbitrary block between each comment block, and
finaly this attacker could smash memory particularly on architecture
where malloc layout is predictable.
Worst the bug could be exploited remotly throught php-magick or perlmagick.
A special image leading to malloc space corruption and thus a dos is available.

Imagemagick before version 6.7.8-8 are affected.

See upstream bug report here:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921

First reported as a dos here:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248

Fixed by commit:
http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c

Analysis by myself

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.