[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <3454029.yBeZ0OJpNZ@arcadia>
Date: Fri, 02 Dec 2016 19:16:04 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556)
On Friday 02 December 2016 13:07:34 cve-assign@...re.org wrote:
> > https://blogs.gentoo.org/ago/2016/12/01/imagemagick-heap-based-buffer-over
> > flow-in-ispixelgray-pixel-accessor-h-incomplete-fix-for-cve-2016-9556
> >
> > AddressSanitizer: heap-buffer-overflow
> > READ of size 4
> >
> > #0 0x7f897b123266 in IsPixelGray
> > ImageMagick-7.0.3-8/./MagickCore/pixel-accessor.h:507:30
>
> Use CVE-2016-9773 for the vulnerability present in "an updated version
> which includes the fix for CVE-2016-9556."
The updated version which includes the fix for CVE-2016-9556 is 7.0.3.8 ( as
stated under the affected version 'field'.
Anyway, upstream added a patch for this issue:
https://github.com/ImageMagick/ImageMagick/commit/4e8c2ed53fcb54a34b3a6185b2584f26cf6874a3
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
