oss-sec mailing list archives
CVE request for imagemagick bug
From: Bastien ROUCARIES <roucaries.bastien () gmail com>
Date: Fri, 30 Aug 2013 01:24:33 +0200
The gif handling code of imagemagick allow execution of arbitrary code due to a buffer overflow of one byte. Gif image format is made of different kind of data unit called block and these block may appear at anytime. The code actually do the equivalent of a=malloc(length+count) [line 1 of the patch] and a[length+count]='\0' for each comment block [line 11 of patch]. Because this code is executed for every comment block and that an attacker could put arbitrary block between each comment block, and finaly this attacker could smash memory particularly on architecture where malloc layout is predictable. Worst the bug could be exploited remotly throught php-magick or perlmagick. A special image leading to malloc space corruption and thus a dos is available. Imagemagick before version 6.7.8-8 are affected. See upstream bug report here: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921 First reported as a dos here: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248 Fixed by commit: http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c Analysis by myself
Current thread:
- CVE request for imagemagick bug Bastien ROUCARIES (Aug 30)
- Re: CVE request for imagemagick bug Kurt Seifried (Sep 03)