Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 20 Dec 2019 13:11:08 +0530
From: Mohammad Tausif Siddiqui <msiddiqu@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE requests: three vulnerabilities in ImageMagick

Hi Galycannon,

Whom did you request the CVE ? Please follow this:
https://cve.mitre.org/cve/request_id.html

On Thu, Dec 19, 2019 at 5:14 PM GalyCannon <galycannon@...il.com> wrote:

> Hi,
>    I have found three vulnerabilities in ImageMagick and all this have
> patched by ImageMagick developer team. However, I requested cve ids for
> these vulveribilities and get no any response. How should I  request CVE
> ids for vulnerilities I found in ImageMagick now? Which CNA should I
> contact with to assign CVE ids for open source software such as
> imagemagick?
>    The three vulnerabilities details as below.
>     1. heap-buffer-overflow in WritePNGImage of png.c
> [Suggested description]
> In ImageMagick  7.0.8-43  and ImageMagick6  6.9.10-43, there is a
> heap-buffer-overflow overflow in the function WritePNGImage of png.c ,
> which allows remote attackers to cause  arbitrary code execution, denial of
> service or possibly have unspecified other impact via a crafted image file
> .
> [Vendor of Product]
> https://imagemagick.org
> [Affected Component]
> function WritePNGImage of png.c
> [Attack Type]
> Remote
> [Attack Vectors]
> magick convert $poc ./test.png
> [Reference]
> https://github.com/ImageMagick/ImageMagick/issues/1561
>
> https://github.com/ImageMagick/ImageMagick6/commit/34adc98afd5c7e7fb774d2ebdaea39e831c24dce
>
>
> https://github.com/ImageMagick/ImageMagick/commit/d17c047f7bff7c0edbf304470cd2ab9d02fbf617
>
> [Discoverer]
> galycannon of JDCloud Security Team
>
>    2. heap-buffer-overflow in WriteSGIImage of coders/sgi.c
> [Suggested description]
> In ImageMagick  7.0.8-43  and ImageMagick6  6.9.10-43, there is a
> heap-buffer-overflow overflow in the function WriteSGIImage of coders/sgi.c
> , which allows remote attackers to cause  arbitrary code execution, denial
> of service or possibly have unspecified other impact via a crafted image
> file  .
> [Vendor of Product]
> https://imagemagick.org
> [Affected Component]
> function WriteSGIImage of coders/sgi.c
> [Attack Type]
> Remote
> [Attack Vectors]
> magick convert $poc ./test.sgi
> [Reference]
> https://github.com/ImageMagick/ImageMagick/issues/1562
>
> https://github.com/ImageMagick/ImageMagick/commit/6ae32a9038e360b3491969d5d03d490884f02b4c
>
>
> https://github.com/ImageMagick/ImageMagick6/commit/9e7db22f8c374301db3f968757f0d08070fd4e54
>
> [Discoverer]
> galycannon of JDCloud Security Team
>
>  3. heap-use-after-free in MngInfoDiscardObject of coders/png.c
> [Suggested description]
> In ImageMagick   7.0.9-7, there is a heap-use-after-free in function
> MngInfoDiscardObject of coders/png.c , which allows remote attackers to
> cause  arbitrary code execution, denial of service or possibly have
> unspecified other impact via a crafted image file  .
> [Vendor of Product]
> https://imagemagick.org
> [Affected Component]
> function MngInfoDiscardObject of coders/png.c
> [Attack Type]
> Remote
> [Attack Vectors]
> magick convert $poc /dev/null
> [Reference]
> https://github.com/ImageMagick/ImageMagick/issues/1791
>
> https://github.com/ImageMagick/ImageMagick/commit/916d7bbd2c66a286d379dbd94bc6035c8fab937c
>
> [Discoverer]
> galycannon of JDCloud Security Team
>
> Regards,
> galycannon
>


-- 

Tausif Siddiqui

Red Hat Product Security

0EE1 F6BF 8991 9A65 0A79  A0A7 5849 60EC 88B8 2C71

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.