#VU33182 Heap-based buffer overflow in GraphicsMagick - CVE-2016-7996

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier. A remote attacker can use a colormap with a large number of entries. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

External links

• http://www.debian.org/security/2016/dsa-3746
• http://www.openwall.com/lists/oss-security/2016/10/07/4
• http://www.openwall.com/lists/oss-security/2016/10/08/5
• http://www.securityfocus.com/bid/93464