Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456.

This update fixes a broken patch for CVE-2006-5456 and minor non-security issues. (CVE-2007-0770)

Vladimir Nadvornik discovered that the fix for CVE-2006-5456, released in USN-372-1, did not correctly solve the original flaw in PALM image handling. By tricking a user into processing a specially crafted image with an application that uses imagemagick, an attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vladimir Nadvornik discovered a buffer overflow in GraphicsMagick and ImageMagick allows user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.

This is related to an earlier fix for CVE-2006-5456 that did not fully correct the issue.

Updated packages have been patched to correct this issue.

Vladimir Nadvornik discovered that the fix for a vulnerability in the PALM decoder of Imagemagick, a collection of image manipulation programs, was ineffective. To avoid confusion a new CVE ID has been assigned; the original issue was tracked as CVE-2006-5456.

ID	Name	Product	Family	Severity
29350	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2592)	Nessus	SuSE Local Security Checks	high
28014	Ubuntu 5.10 / 6.06 LTS / 6.10 : imagemagick vulnerabilities (USN-422-1)	Nessus	Ubuntu Local Security Checks	high
27107	openSUSE 10 Security Update : ImageMagick (ImageMagick-2585)	Nessus	SuSE Local Security Checks	high
27102	openSUSE 10 Security Update : GraphicsMagick (GraphicsMagick-2593)	Nessus	SuSE Local Security Checks	high
24654	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2007:041)	Nessus	Mandriva Local Security Checks	high
24347	Debian DSA-1260-1 : imagemagick - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-0770

high

Tenable Plugins

high

high

high

high

high

high