Date: Fri, 02 Dec 2016 19:16:04 +0100 From: Agostino Sarubbo <ago@...too.org> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) On Friday 02 December 2016 13:07:34 cve-assign@...re.org wrote: > > https://blogs.gentoo.org/ago/2016/12/01/imagemagick-heap-based-buffer-over > > flow-in-ispixelgray-pixel-accessor-h-incomplete-fix-for-cve-2016-9556 > > > > AddressSanitizer: heap-buffer-overflow > > READ of size 4 > > > > #0 0x7f897b123266 in IsPixelGray > > ImageMagick-7.0.3-8/./MagickCore/pixel-accessor.h:507:30 > > Use CVE-2016-9773 for the vulnerability present in "an updated version > which includes the fix for CVE-2016-9556." The updated version which includes the fix for CVE-2016-9556 is 220.127.116.11 ( as stated under the affected version 'field'. Anyway, upstream added a patch for this issue: https://github.com/ImageMagick/ImageMagick/commit/4e8c2ed53fcb54a34b3a6185b2584f26cf6874a3 -- Agostino Sarubbo Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.