Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Date: Tue, 9 Feb 2016 14:08:35 +0100
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE requests: Multiple vulnerabilities in GraphicsMagick parsing and
 processing SVG files

Hi,

We recently tested the last release of GraphicsMagick (1.3.23) with our
tool and found some vulnerabilities that allows to read or write outside
memory bounds (heap, stack) as well as some null-pointer derreferences to
cause DoS. All these bugs are related with the parsing and processing of
SVG files. Upstream is notified and working to fix them but in the meantime
be carefull if you process untrusted SVG files using GraphicsMagick.

Here is the summary of vulnerabilities we found. Reproducers are attached.

/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-1114777018469422437 bmp:/dev/null
=================================================================
==25335==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x7fffeff75da0 at pc 0x0000005a892c bp 0x7fffffff2250 sp 0x7fffffff2248
WRITE of size 8 at 0x7fffeff75da0 thread T0
    #0 0x5a892b in TracePoint magick/render.c:5125
    #1 0x5a56a6 in TraceEllipse magick/render.c:4721
    #2 0x5a94f1 in TraceRoundRectangle magick/render.c:5191
    #3 0x59742c in DrawImage magick/render.c:2868
    #4 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #5 0x498e61 in ReadImage magick/constitute.c:1607
    #6 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #7 0x498e61 in ReadImage magick/constitute.c:1607
    #8 0x42690f in ConvertImageCommand magick/command.c:4348
    #9 0x442a31 in MagickCommand magick/command.c:8862
    #10 0x47ca6e in GMCommandSingle magick/command.c:17338
    #11 0x47cd2a in GMCommand magick/command.c:17391
    #12 0x40c9a5 in main utilities/gm.c:61
    #13 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #14 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-632425326915265752 bmp:/dev/null
=================================================================
==26846==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7fffffff8005 at pc 0x00000060ba3b bp 0x7fffffff7680 sp 0x7fffffff7678
WRITE of size 1 at 0x7fffffff8005 thread T0
    #0 0x60ba3a in GetToken magick/utility.c:2638
    #1 0x93a981 in GetUserSpaceCoordinateValue coders/svg.c:236
    #2 0x93ea73 in SVGStartElement coders/svg.c:765
    #3 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #4 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #5 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #6 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #7 0x498e61 in ReadImage magick/constitute.c:1607
    #8 0x42690f in ConvertImageCommand magick/command.c:4348
    #9 0x442a31 in MagickCommand magick/command.c:8862
    #10 0x47ca6e in GMCommandSingle magick/command.c:17338
    #11 0x47cd2a in GMCommand magick/command.c:17391
    #12 0x40c9a5 in main utilities/gm.c:61
    #13 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #14 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)

Address 0x7fffffff8005 is located in stack of thread T0 at offset 2149 in
frame
    #0 0x93a5dd in GetUserSpaceCoordinateValue coders/svg.c:210

  This frame has 2 object(s):
    [32, 40) 'p'
    [96, 2149) 'token' <== Memory access at offset 2149 overflows this
variable

/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-7101924735921376511 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26861==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x00000059866b bp 0x7fffffff7b80 sp 0x7fffffff2530 T0)
    #0 0x59866a in DrawImage magick/render.c:2999
    #1 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #2 0x498e61 in ReadImage magick/constitute.c:1607
    #3 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #4 0x498e61 in ReadImage magick/constitute.c:1607
    #5 0x42690f in ConvertImageCommand magick/command.c:4348
    #6 0x442a31 in MagickCommand magick/command.c:8862
    #7 0x47ca6e in GMCommandSingle magick/command.c:17338
    #8 0x47cd2a in GMCommand magick/command.c:17391
    #9 0x40c9a5 in main utilities/gm.c:61
    #10 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #11 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.4071333061660627683 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26881==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000945794 bp 0x7fffffff9540 sp 0x7fffffff8070 T0)
    #0 0x945793 in SVGStartElement coders/svg.c:1757
    #1 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #2 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #3 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #4 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #5 0x498e61 in ReadImage magick/constitute.c:1607
    #6 0x42690f in ConvertImageCommand magick/command.c:4348
    #7 0x442a31 in MagickCommand magick/command.c:8862
    #8 0x47ca6e in GMCommandSingle magick/command.c:17338
    #9 0x47cd2a in GMCommand magick/command.c:17391
    #10 0x40c9a5 in main utilities/gm.c:61
    #11 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #12 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.4495884156523242589 bmp:/dev/null
=================================================================
==26893==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60700000da50 at pc 0x00000093c005 bp 0x7fffffff8000 sp 0x7fffffff7ff8
WRITE of size 8 at 0x60700000da50 thread T0
    #0 0x93c004 in GetTransformTokens coders/svg.c:361
    #1 0x9455f2 in SVGStartElement coders/svg.c:1748
    #2 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #3 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #4 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #5 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #6 0x498e61 in ReadImage magick/constitute.c:1607
    #7 0x42690f in ConvertImageCommand magick/command.c:4348
    #8 0x442a31 in MagickCommand magick/command.c:8862
    #9 0x47ca6e in GMCommandSingle magick/command.c:17338
    #10 0x47cd2a in GMCommand magick/command.c:17391
    #11 0x40c9a5 in main utilities/gm.c:61
    #12 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #13 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.7960082311810466150 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26901==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x0000005a396d bp 0x7fffffff1a80 sp 0x7fffffff18a0 T0)
    #0 0x5a396c in TraceArcPath magick/render.c:4550
    #1 0x5a6729 in TracePath magick/render.c:4852
    #2 0x597f23 in DrawImage magick/render.c:2945
    #3 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #4 0x498e61 in ReadImage magick/constitute.c:1607
    #5 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #6 0x498e61 in ReadImage magick/constitute.c:1607
    #7 0x42690f in ConvertImageCommand magick/command.c:4348
    #8 0x442a31 in MagickCommand magick/command.c:8862
    #9 0x47ca6e in GMCommandSingle magick/command.c:17338
    #10 0x47cd2a in GMCommand magick/command.c:17391
    #11 0x40c9a5 in main utilities/gm.c:61
    #12 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #13 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)

Regards,
Gus.

Content of type "text/html" skipped

Download attachment "aaphrbkwwe.svg.-1114777018469422437" of type "application/octet-stream" (7493 bytes)

Download attachment "aaphrbkwwe.svg.-632425326915265752" of type "application/octet-stream" (36077 bytes)

Download attachment "aaphrbkwwe.svg.-7101924735921376511" of type "application/octet-stream" (1021 bytes)

Download attachment "aaphrbkwwe.svg.4071333061660627683" of type "application/octet-stream" (2107 bytes)

Download attachment "aaphrbkwwe.svg.4495884156523242589" of type "application/octet-stream" (973 bytes)

Download attachment "aaphrbkwwe.svg.7960082311810466150" of type "application/octet-stream" (1613 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.