SB2018121813 - Denial of service in GraphicsMagick

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2018-20189)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to an error in the ReadDIBImage function of coders/dib.c when processing malicious input in DIB reader. A remote attacker can cause the service to crash via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.

2) Heap-based buffer overflow (CVE-ID: CVE-2018-20184)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the WriteTGAImage function of tga.c when processing malicious input. A remote attacker can cause the service to crash via a crafted image file, because the number of rows or columns can exceed the pixel-dimension restrictions of the TGA specification.

3) Heap-based buffer over-read (CVE-ID: CVE-2018-20185)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in GraphicsMagick installations with customized BMP limits due to heap-based buffer over-read in the ReadBMPImage function of bmp.c when processing malicious input. A remote attacker can cause the service to crash via a crafted bmp image file.

Remediation

Install update from vendor's website.

References

• http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e2b406589
• http://www.graphicsmagick.org/NEWS.html#june-15-2019
• https://sourceforge.net/p/graphicsmagick/bugs/583/
• https://sourceforge.net/p/graphicsmagick/bugs/582/