SB2017110107 - Multiple vulnerabilities in GraphicsMagick

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2017-14314)

The vulnerability allows a remote attacker to cause DoS condition on th etarget system.

The weakness exists in the DrawImage function in magick/render.c due to off-by-one error. A remote attacker can trick the victim into opening a specially crafted file, trigger heap-based buffer over-read and cause the service to crash.

2) Heap-based buffer overflow (CVE-ID: CVE-2017-16352)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file due to heap-based buffer overflow. A remote attacker can trick the victim into opening a specially crafted MIFF format file with the verbose flag, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

3) Memory corruption (CVE-ID: CVE-2017-16353)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the DescribeImage function of the magick/describe.c file due to heap-based buffer over-read because the portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image and out-of-bounds buffer dereference because certain increments are never checked. A remote attacker can trick the victim into opening a specially crafted MIFF file and gain access to potentially sensitive information.

Remediation

Install update from vendor's website.

References

• http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=7292230dd185
• http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=e4e1c2a581d8