Full Disclosure mailing list archives
[ GLSA 200409-12 ] ImageMagick, imlib, imlib2: BMP decoding buffer overflows
From: Thierry Carrez <koon () gentoo org>
Date: Wed, 08 Sep 2004 11:03:19 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: ImageMagick, imlib, imlib2: BMP decoding buffer overflows Date: September 08, 2004 Bugs: #62309, #62487 ID: 200409-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== ImageMagick, imlib and imlib2 contain exploitable buffer overflow vulnerabilities in the BMP image processing code. Background ========== ImageMagick is a suite of image manipulation utilities and libraries used for a wide variety of image formats. imlib is a general image loading and rendering library. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-gfx/imagemagick < 6.0.7.1 >= 6.0.7.1 2 media-libs/imlib < 1.9.14-r2 >= 1.9.14-r2 3 media-libs/imlib2 < 1.1.2 >= 1.1.2 ------------------------------------------------------------------- 3 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== Due to improper bounds checking, ImageMagick and imlib are vulnerable to a buffer overflow when decoding runlength-encoded bitmaps. This bug can be exploited using a specially-crafted BMP image and could potentially allow remote code execution when this image is decoded by the user. Impact ====== A specially-crafted runlength-encoded BMP could lead ImageMagick and imlib to crash or potentially execute arbitrary code. Workaround ========== There is no known workaround at this time. Resolution ========== All ImageMagick users should upgrade to the latest version: # emerge sync # emerge -pv ">=media-gfx/imagemagick-6.0.7.1" # emerge ">=media-gfx/imagemagick-6.0.7.1" All imlib users should upgrade to the latest version: # emerge sync # emerge -pv ">=media-libs/imlib-1.9.14-r2" # emerge ">=media-libs/imlib-1.9.14-r2" All imlib2 users should upgrade to the latest version: # emerge sync # emerge -pv ">=media-libs/imlib2-1.1.2" # emerge ">=media-libs/imlib2-1.1.2" References ========== [ 1 ] CAN-2004-0817 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0817 [ 2 ] CAN-2004-0802 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0802 [ 3 ] ImageMagick Mailing List http://studio.imagemagick.org/pipermail/magick-developers/2004-August/002011.html [ 4 ] SecurityTracker #1011104 http://securitytracker.com/alerts/2004/Aug/1011104.html [ 5 ] SecurityTracker #1011105 http://securitytracker.com/alerts/2004/Aug/1011105.html Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200409-12.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/1.0 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBPsrXvcL1obalX08RAiMWAJ9jRgAsJDcmL5JF/EZrn0BREPo5egCgpomO W24qtwrG1lisZYBSGyyWrRI= =XLhl -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [ GLSA 200409-12 ] ImageMagick, imlib, imlib2: BMP decoding buffer overflows Thierry Carrez (Sep 08)