[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 6 Feb 2016 10:11:06 -0500 (EST)
From: cve-assign@...re.org
To: gustavo.grieco@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: Out-of-bound read in the parsing of gif files using GraphicsMagick 1.3.18
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> We found a read out-of-bound in the parsing of gif files using
> GraphicsMagick. This issue was tested in Ubuntu 14.04 (x86_64) using
> GraphicsMagick 1.3.18.
>
> $ ./gm identify overflow.gif
>
> AddressSanitizer: heap-buffer-overflow
> READ of size 1
>
> SUMMARY: AddressSanitizer: heap-buffer-overflow coders/gif.c:276 DecodeImage
>
> This issue is caused by the use of unintialized memory in DecodeImage and
> fortunately it was fixed here:
>
> http://marc.info/?l=graphicsmagick-commit&m=142283721604323&w=2
>> Date: 2015-02-02 0:33:27
>>
>> coders/gif.c (DecodeImage): Assure that GIF decoder does not use
>> unitialized data.
>> + (void) memset(prefix,0,MaxStackSize*sizeof(short));
>> + (void) memset(suffix,0,MaxStackSize);
Use CVE-2015-8808.
The scope of this CVE does not include the "FIXME: Is the logic for
this loop (or the loop which inits suffix and prefix arrays) correct?
Values are intentionally accessed outside of the explictly initialized
range of 'clear'." observation in the same commit.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWtgyDAAoJEL54rhJi8gl5is8P/0gbJvpqOZvw+8wfuBUsyJJG
wQ4PUn/+Kgo5SWH3dRpSRyoN8OMr0mtO0ikWGVTpYvIGP6PCLi3zv6utJyTXjj11
EdGB6HCjvvCVQBIFyXP2fPQVK8hhwIwsiFqLoER9ZgHnGwRTOOrvkuaVIJeugHRl
4RfdbEcPSNX0OtAk+lrpuv0YwQmlRRLK1ddt2GTh2L5Jzr/eRYJo8/QArFSzKu8n
qJcW6bHx48w+2LXcQPPvexvxiRwCsSREKldKO9UWLZZO19dFQKhTGs254WnKyVq7
byEsl6j49a4OvkLAB2CiLBTVyfYjuuWfpQdLAnjqx7YL6k5K3DlIozc387my8nz/
BgwS3lK+ci8E7JEIg8hxXDrG5rENMGnIYJGX7WarEsonqbE7RKw/hwsygK0rl8dh
gnFG8tPR1lP8ILegk7Jb8f6zsgUrMOqcwSjZXzRlEOX4BHbj6Q/zm+qTeYsasfhC
8FfVfoN7o7P3wsHjlZ+sHX/+wwtzlor8/s3/kQBeIsksC2/HGUfkfUWpfjV0Bma8
40PEfRhslxiFcwPb1BZZUq0L8wDN+utWMtL4uwmj7VVwmvNKUpO/yWsmdiA6AXPl
y6fVZVaqH1TAHeCResnGV+zwcnbZngHfGIzdc2SKyEKUf4csq7pE4aTUzcE/sgE9
Lg2goBw9tbht7gJhkjMQ
=fCxG
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
