From ${URL} : We recently tested the last release of GraphicsMagick (1.3.23) with our tool and found some vulnerabilities that allows to read or write outside memory bounds (heap, stack) as well as some null-pointer derreferences to cause DoS. All these bugs are related with the parsing and processing of SVG files. Upstream is notified and working to fix them but in the meantime be carefull if you process untrusted SVG files using GraphicsMagick. Here is the summary of vulnerabilities we found. Reproducers are attached. /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.-1114777018469422437 bmp:/dev/null ================================================================= ==25335==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fffeff75da0 at pc 0x0000005a892c bp 0x7fffffff2250 sp 0x7fffffff2248 WRITE of size 8 at 0x7fffeff75da0 thread T0 #0 0x5a892b in TracePoint magick/render.c:5125 #1 0x5a56a6 in TraceEllipse magick/render.c:4721 #2 0x5a94f1 in TraceRoundRectangle magick/render.c:5191 #3 0x59742c in DrawImage magick/render.c:2868 #4 0x88bb1d in ReadMVGImage coders/mvg.c:195 #5 0x498e61 in ReadImage magick/constitute.c:1607 #6 0x94ee83 in ReadSVGImage coders/svg.c:2752 #7 0x498e61 in ReadImage magick/constitute.c:1607 #8 0x42690f in ConvertImageCommand magick/command.c:4348 #9 0x442a31 in MagickCommand magick/command.c:8862 #10 0x47ca6e in GMCommandSingle magick/command.c:17338 #11 0x47cd2a in GMCommand magick/command.c:17391 #12 0x40c9a5 in main utilities/gm.c:61 #13 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #14 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.-632425326915265752 bmp:/dev/null ================================================================= ==26846==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffff8005 at pc 0x00000060ba3b bp 0x7fffffff7680 sp 0x7fffffff7678 WRITE of size 1 at 0x7fffffff8005 thread T0 #0 0x60ba3a in GetToken magick/utility.c:2638 #1 0x93a981 in GetUserSpaceCoordinateValue coders/svg.c:236 #2 0x93ea73 in SVGStartElement coders/svg.c:765 #3 0x7ffff518ca74 in xmlParseStartTag (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74) #4 0x7ffff5199f92 (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92) #5 0x7ffff519af9d in xmlParseChunk (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d) #6 0x94ea5d in ReadSVGImage coders/svg.c:2724 #7 0x498e61 in ReadImage magick/constitute.c:1607 #8 0x42690f in ConvertImageCommand magick/command.c:4348 #9 0x442a31 in MagickCommand magick/command.c:8862 #10 0x47ca6e in GMCommandSingle magick/command.c:17338 #11 0x47cd2a in GMCommand magick/command.c:17391 #12 0x40c9a5 in main utilities/gm.c:61 #13 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #14 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) Address 0x7fffffff8005 is located in stack of thread T0 at offset 2149 in frame #0 0x93a5dd in GetUserSpaceCoordinateValue coders/svg.c:210 This frame has 2 object(s): [32, 40) 'p' [96, 2149) 'token' <== Memory access at offset 2149 overflows this variable /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.-7101924735921376511 bmp:/dev/null ASAN:SIGSEGV ================================================================= ==26861==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000059866b bp 0x7fffffff7b80 sp 0x7fffffff2530 T0) #0 0x59866a in DrawImage magick/render.c:2999 #1 0x88bb1d in ReadMVGImage coders/mvg.c:195 #2 0x498e61 in ReadImage magick/constitute.c:1607 #3 0x94ee83 in ReadSVGImage coders/svg.c:2752 #4 0x498e61 in ReadImage magick/constitute.c:1607 #5 0x42690f in ConvertImageCommand magick/command.c:4348 #6 0x442a31 in MagickCommand magick/command.c:8862 #7 0x47ca6e in GMCommandSingle magick/command.c:17338 #8 0x47cd2a in GMCommand magick/command.c:17391 #9 0x40c9a5 in main utilities/gm.c:61 #10 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #11 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.4071333061660627683 bmp:/dev/null ASAN:SIGSEGV ================================================================= ==26881==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000945794 bp 0x7fffffff9540 sp 0x7fffffff8070 T0) #0 0x945793 in SVGStartElement coders/svg.c:1757 #1 0x7ffff518ca74 in xmlParseStartTag (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74) #2 0x7ffff5199f92 (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92) #3 0x7ffff519af9d in xmlParseChunk (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d) #4 0x94ea5d in ReadSVGImage coders/svg.c:2724 #5 0x498e61 in ReadImage magick/constitute.c:1607 #6 0x42690f in ConvertImageCommand magick/command.c:4348 #7 0x442a31 in MagickCommand magick/command.c:8862 #8 0x47ca6e in GMCommandSingle magick/command.c:17338 #9 0x47cd2a in GMCommand magick/command.c:17391 #10 0x40c9a5 in main utilities/gm.c:61 #11 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #12 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.4495884156523242589 bmp:/dev/null ================================================================= ==26893==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000da50 at pc 0x00000093c005 bp 0x7fffffff8000 sp 0x7fffffff7ff8 WRITE of size 8 at 0x60700000da50 thread T0 #0 0x93c004 in GetTransformTokens coders/svg.c:361 #1 0x9455f2 in SVGStartElement coders/svg.c:1748 #2 0x7ffff518ca74 in xmlParseStartTag (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74) #3 0x7ffff5199f92 (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92) #4 0x7ffff519af9d in xmlParseChunk (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d) #5 0x94ea5d in ReadSVGImage coders/svg.c:2724 #6 0x498e61 in ReadImage magick/constitute.c:1607 #7 0x42690f in ConvertImageCommand magick/command.c:4348 #8 0x442a31 in MagickCommand magick/command.c:8862 #9 0x47ca6e in GMCommandSingle magick/command.c:17338 #10 0x47cd2a in GMCommand magick/command.c:17391 #11 0x40c9a5 in main utilities/gm.c:61 #12 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #13 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) /home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize 128x128 aaphrbkwwe.svg.7960082311810466150 bmp:/dev/null ASAN:SIGSEGV ================================================================= ==26901==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005a396d bp 0x7fffffff1a80 sp 0x7fffffff18a0 T0) #0 0x5a396c in TraceArcPath magick/render.c:4550 #1 0x5a6729 in TracePath magick/render.c:4852 #2 0x597f23 in DrawImage magick/render.c:2945 #3 0x88bb1d in ReadMVGImage coders/mvg.c:195 #4 0x498e61 in ReadImage magick/constitute.c:1607 #5 0x94ee83 in ReadSVGImage coders/svg.c:2752 #6 0x498e61 in ReadImage magick/constitute.c:1607 #7 0x42690f in ConvertImageCommand magick/command.c:4348 #8 0x442a31 in MagickCommand magick/command.c:8862 #9 0x47ca6e in GMCommandSingle magick/command.c:17338 #10 0x47cd2a in GMCommand magick/command.c:17391 #11 0x40c9a5 in main utilities/gm.c:61 #12 0x7ffff3739ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #13 0x40c8b8 (/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8) @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Arches, please test and mark stable: =media-gfx/graphicsmagick-1.3.25 Target keywords : "alpha amd64 hppa ia64 ppc ppc64 sparc x86"
Stable on alpha.
amd64 stable
x86 stable
Stable for HPPA PPC64.
sparc stable
ppc stable
ia64 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
No PoC on ACE or privilege escalation. Severity lowered. Tree is clean: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dab8a3b0926a4945e88fb532ef086ef263e3afe0
