ImageMagick: CVE-2017-9098: use of uninitialized memory in RLE decoder

[Salvatore Bonaccorso <carnil () debian org>]

Hi

Chris Evans discovered that ImageMagick uses unitialized memory in the
RLE decoder, allowing an attacker to leak sensitive information from
process memory space. There is missing initialization in the
ReadRLEImage function.

Original article at:

https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html

Upstream fix:

https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b

For reference and for list archivng purpose I'm attaching the text
part of the finding.

Regards,
Salvatore

Attachment: CVE-2017-9098.txt
Description: