[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAE2SPAZgeLGOq+WKDgf-PTuyDn3629geBuVrWUyQjzZZhcYaoQ@mail.gmail.com>
Date: Fri, 30 Aug 2013 01:24:33 +0200
From: Bastien ROUCARIES <roucaries.bastien@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request for imagemagick bug
The gif handling code of imagemagick allow execution of arbitrary code
due to a buffer overflow of one byte.
Gif image format is made of different kind of data unit called block
and these block may appear at anytime.
The code actually do the equivalent of a=malloc(length+count) [line 1
of the patch] and a[length+count]='\0' for each comment block [line
11 of patch].
Because this code is executed for every comment block and that an
attacker could put arbitrary block between each comment block, and
finaly this attacker could smash memory particularly on architecture
where malloc layout is predictable.
Worst the bug could be exploited remotly throught php-magick or perlmagick.
A special image leading to malloc space corruption and thus a dos is available.
Imagemagick before version 6.7.8-8 are affected.
See upstream bug report here:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921
First reported as a dos here:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248
Fixed by commit:
http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c
Analysis by myself
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
