Bugzilla Bug 152668

TITLE:
GraphicsMagick PALM and DCM Buffer Overflows

SECUNIA ADVISORY ID:
SA22569

VERIFY ADVISORY:
http://secunia.com/advisories/22569/

CRITICAL:
Moderately critical

IMPACT:
DoS, System access

WHERE:
From remote

SOFTWARE:
GraphicsMagick 1.x
http://secunia.com/product/3764/

DESCRIPTION:
Some vulnerabilities have been reported in GraphicsMagick, which can
be exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise a vulnerable system.

1) A boundary error within the "ReadDCMImage()" function in
coders/dcm.c can be exploited to cause a buffer overflow when
processing specially crafted DCM images.

2) Several boundary errors within the "ReadPALMImage()" function in
coders/palm.c can be exploited to cause heap-based buffer overflows
when processing specially crafted PALM images.

Successful exploitation may allow the execution of arbitrary code.

SOLUTION:
Do not open untrusted PALM and DCM images.

PROVIDED AND/OR DISCOVERED BY:
M. Joonas Pihlaja

ORIGINAL ADVISORY:
http://packages.debian.org/changelogs/pool/main/g/graphicsmagick/graphicsmagick_1.1.7-9/changelog#versionversion1.1.7-9

kloeri, pls provide an updated ebuild

Added 1.1.7-r3 with fixes for dcm and palm coders.

thanks kloeri

arches, pls test and mark stable if possible


wow... I really thought of using the button this time... ;-)

ppc is safe

1. emerges on x86
2. passes collision test
3. seems to work

media-gfx/graphicsmagick-1.1.7-r3  USE="X depth16 depth32 gs jpeg jpeg2k lcms
lzw perl png tiff truetype wmf xml -doc -jbig"

Portage 2.1.1-r1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3,
2.6.18.1 i686)
=================================================================
System uname: 2.6.18.1 i686 Genuine Intel(R) CPU           T2300  @ 1.66GHz
Gentoo Base System version 1.12.6
Last Sync: Fri, 03 Nov 2006 13:50:01 +0000
ccache version 2.3 [disabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.3
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.60
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r4
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r1
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="autoconfig collision-protect distlocks metadata-transfer
parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LINGUAS="en de en_GB de_CH"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="x86 X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom
cli cracklib crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds
elibc_glibc emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm
gstreamer gtk hal iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog
java jpeg kde kernel_linux ldap libg++ linguas_de linguas_de_CH linguas_en
linguas_en_GB mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl
oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection
rtsp samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd test tetex
theora threads truetype truetype-fonts type1-fonts udev unicode userland_GNU
vcd video_cards_fbdev video_cards_i810 video_cards_vesa vorbis win32codecs
wxwindows x264 xine xml xorg xprint xv xvid zlib"
Unset:  CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS,
PORTDIR_OVERLAY

x86 wears the heavy armour now

sorry, my internet connection is broken currently..

ppc64 stable

Stable on ia64.

GLSA 200611-07, thanks everybody