DSA-3799

[oss-security] 20170116 CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors

[oss-security] 20170116 Re: CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors

95755

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851376

https://github.com/ImageMagick/ImageMagick/commit/91cc3f36f2ccbd485a0456bab9aebe63b635da88

https://github.com/ImageMagick/ImageMagick/commit/e87af64b1ff1635a32d9b6162f1b0e260fb54ed9

https://github.com/ImageMagick/ImageMagick/issues/348

GLSA-201702-09

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick is an image display and manipulation tool     for the X Window System. ImageMagick can read and write     JPEG, TIFF, PNM, GIF,and Photo CD image formats. It can     resize, rotate, sharpen, color reduce, or add special     effects to an image, and when finished you can either     save the completed work in the original format or a     different one. ImageMagick also includes command line     programs for creating animated or transparent .gifs,     creating composite images, creating thumbnail images,     and more.ImageMagick is one of your choices if you need     a program to manipulate and display images. If you want     to develop your own applications which use ImageMagick     code or APIs, you need to install ImageMagick-devel as     well.Security Fix(es):In ImageMagick before 7.0.8-8, a     NULL pointer dereference exists in the     GetMagickProperty function in     MagickCore/property.c.(CVE-2018-16329)ImageMagick     before 6.9.9-24 and 7.x before 7.0.7-12 has a     use-after-free in Magick::Image::read in     Magick++/lib/Image.cpp.(CVE-2017-17499)In ImageMagick     before 6.9.8-5 and 7.x before 7.0.5-6, there is a     memory leak in the ReadMATImage function in     coders/mat.c.(CVE-2017-13146)In ImageMagick before     6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage     function in coders/mat.c uses uninitialized data, which     might allow remote attackers to obtain sensitive     information from process memory.(CVE-2017-13143)In     ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the     ReadOneMNGImage function in coders/png.c has an     out-of-bounds read with the MNG CLIP     chunk.(CVE-2017-13139)coders/psd.c in ImageMagick     allows remote attackers to have unspecified impact via     a crafted PSD file, which triggers an out-of-bounds     write.(CVE-2017-5510)coders/psd.c in ImageMagick allows     remote attackers to have unspecified impact via a     crafted PSD file, which triggers an out-of-bounds     write.(CVE-2017-5509)Memory leak in coders/mpc.c in     ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4     allows remote attackers to cause a denial of service     (memory consumption) via vectors involving a pixel     cache.(CVE-2017-5507)Memory leak in the IsOptionMember     function in MagickCore/option.c in ImageMagick before     6.9.2-2, as used in ODR-PadEnc and other products,     allows attackers to trigger memory     consumption.(CVE-2016-10252)Off-by-one error in     coders/wpg.c in ImageMagick allows remote attackers to     have unspecified impact via vectors related to a string     copy.(CVE-2016-10145)Memory leak in     AcquireVirtualMemory in ImageMagick before 7 allows     remote attackers to cause a denial of service (memory     consumption) via unspecified vectors.(CVE-2016-7539)In     coders/bmp.c in ImageMagick before 7.0.8-16, an input     file can result in an infinite loop and hang, with high     CPU and memory consumption. Remote attackers could     leverage this vulnerability to cause a denial of     service via a crafted file.(CVE-2018-20467)In     ImageMagick before 7.0.8-8, a NULL pointer dereference     exists in the CheckEventLogging function in     MagickCore/log.c.(CVE-2018-16328)ReadXBMImage in     coders/xbm.c in ImageMagick before 7.0.8-9 leaves data     uninitialized when processing an XBM file that has a     negative pixel value. If the affected code is used as a     library loaded into a process that includes sensitive     information, that information sometimes can be leaked     via the image data.(CVE-2018-16323)WriteEPTImage in     coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote     attackers to cause a denial of service     (MagickCore/memory.c double free and application crash)     or possibly have unspecified other impact via a crafted     file.(CVE-2018-8804)In ImageMagick 7.0.8-3 Q16,     ReadDIBImage and WriteDIBImage in coders/dib.c allow     attackers to cause an out of bounds write via a crafted     file.(CVE-2018-12600)ImageMagick version 7.0.7-2     contains a memory leak in ReadYUVImage in     coders/yuv.c.(CVE-2017-15033)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Please reference CVE/URL list for details

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2016-10046: Prevent buffer overflow in draw.c caused     by an incorrect length calculation (bsc#1017308)

  - CVE-2016-10048: Arbitrary module could have been load     because relative path were not escaped (bsc#1017310)

  - CVE-2016-10049: Corrupt RLE files could have overflowed     a buffer due to a incorrect length calculation     (bsc#1017311)

  - CVE-2016-10050: Corrupt RLE files could have overflowed     a heap buffer due to a missing offset check     (bsc#1017312)

  - CVE-2016-10051: Fixed use after free when reading PWP     files (bsc#1017313)

  - CVE-2016-10052: Added bound check to exif parsing of     JPEG files (bsc#1017314)

  - CVE-2016-10059: Unchecked calculation when reading TIFF     files could have lead to a buffer overflow (bsc#1017318)

  - CVE-2016-10060: Improved error handling when writing     files to not mask errors (bsc#1017319)

  - CVE-2016-10061: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10062: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10063: Check validity of extend during TIFF     file reading (bsc#1017320)

  - CVE-2016-10064: Improved checks for buffer overflow when     reading TIFF files (bsc#1017321)

  - CVE-2016-10065: Unchecked calculations when reading VIFF     files could have lead to out of bound reads     (bsc#1017322)

  - CVE-2016-10068: Prevent NULL pointer access when using     the MSL interpreter (bsc#1017324)

  - CVE-2016-10069: Add check for invalid mat file     (bsc#1017325).

  - CVE-2016-10070: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10071: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10144: Added a check after allocating memory     when parsing IPL files (bsc#1020433)

  - CVE-2016-10145: Fixed of-by-one in string copy operation     when parsing WPG files (bsc#1020435)

  - CVE-2016-10146: Captions and labels were handled     incorrectly, causing a memory leak that could have lead     to DoS (bsc#1020443)

  - CVE-2017-5506: Missing offset check leading to a     double-free (bsc#1020436)

  - CVE-2017-5507: Fixed a memory leak when reading MPC     files allowing for DoS (bsc#1020439)

  - CVE-2017-5508: Increase the amount of memory allocated     for TIFF pixels to prevent a heap buffer-overflow     (bsc#1020441)

  - CVE-2017-5510: Prevent out-of-bounds write when reading     PSD files (bsc#1020446).

  - CVE-2017-5511: A missing cast when reading PSD files     could have caused memory corruption by a heap overflow     (bsc#1020448)

This update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421).

This update was imported from the SUSE:SLE-12:Update update project.

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, IPL, MPC or PSB files are processed.

This update for ImageMagick fixes the following issues :

  - CVE-2016-10046: Prevent buffer overflow in draw.c caused     by an incorrect length calculation (bsc#1017308)

  - CVE-2016-10048: Arbitrary module could have been load     because relative path were not escaped (bsc#1017310)

  - CVE-2016-10049: Corrupt RLE files could have overflowed     a buffer due to a incorrect length calculation     (bsc#1017311)

  - CVE-2016-10050: Corrupt RLE files could have overflowed     a heap buffer due to a missing offset check     (bsc#1017312)

  - CVE-2016-10051: Fixed use after free when reading PWP     files (bsc#1017313)

  - CVE-2016-10052: Added bound check to exif parsing of     JPEG files (bsc#1017314)

  - CVE-2016-10059: Unchecked calculation when reading TIFF     files could have lead to a buffer overflow (bsc#1017318)

  - CVE-2016-10060: Improved error handling when writing     files to not mask errors (bsc#1017319)

  - CVE-2016-10061: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10062: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10063: Check validity of extend during TIFF     file reading (bsc#1017320)

  - CVE-2016-10064: Improved checks for buffer overflow when     reading TIFF files (bsc#1017321)

  - CVE-2016-10065: Unchecked calculations when reading VIFF     files could have lead to out of bound reads     (bsc#1017322)

  - CVE-2016-10068: Prevent NULL pointer access when using     the MSL interpreter (bsc#1017324)

  - CVE-2016-10069: Add check for invalid mat file     (bsc#1017325).

  - CVE-2016-10070: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10071: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10144: Added a check after allocating memory     when parsing IPL files (bsc#1020433)

  - CVE-2016-10145: Fixed of-by-one in string copy operation     when parsing WPG files (bsc#1020435)

  - CVE-2016-10146: Captions and labels were handled     incorrectly, causing a memory leak that could have lead     to DoS (bsc#1020443)

  - CVE-2017-5506: Missing offset check leading to a     double-free (bsc#1020436)

  - CVE-2017-5507: Fixed a memory leak when reading MPC     files allowing for DoS (bsc#1020439)

  - CVE-2017-5508: Increase the amount of memory allocated     for TIFF pixels to prevent a heap buffer-overflow     (bsc#1020441)

  - CVE-2017-5510: Prevent out-of-bounds write when reading     PSD files (bsc#1020446).

  - CVE-2017-5511: A missing cast when reading PSD files     could have caused memory corruption by a heap overflow     (bsc#1020448) This update removes the fix for     CVE-2016-9773. ImageMagick-6 was not affected by     CVE-2016-9773 and it caused a regression (at least in     GraphicsMagick) (bsc#1017421).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-09 (ImageMagick: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ImageMagick. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Numerous vulnerabilities were discovered in ImageMagick, an image manipulation program. Issues include memory leaks, out of bound reads and missing checks.

This update also includes an update of the fix for CVE-2016-8677 which was incomplete in the previous version.

For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u11.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135519	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-1390)	Nessus	Huawei Local Security Checks	high
131846	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-2354)	Nessus	Huawei Local Security Checks	high
130869	EulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2019-2160)	Nessus	Huawei Local Security Checks	high
100441	FreeBSD : ImageMagick -- multiple vulnerabilities (50776801-4183-11e7-b291-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
97634	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : imagemagick vulnerabilities (USN-3222-1)	Nessus	Ubuntu Local Security Checks	high
97562	openSUSE Security Update : ImageMagick (openSUSE-2017-303)	Nessus	SuSE Local Security Checks	high
97475	Debian DSA-3799-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high
97317	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:0529-1)	Nessus	SuSE Local Security Checks	high
97252	GLSA-201702-09 : ImageMagick: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
96882	Debian DLA-807-1 : imagemagick security update	Nessus	Debian Local Security Checks	high

CVE-2017-5510

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins

high

high

high

high

high

high

high

high

high

high