Bug 593532 (CVE-2016-6491)

Summary:	<media-gfx/imagemagick-6.9.5.10: Out-of-bounds read in CopyMagickMemory
Product:	Gentoo Security	Reporter:	Ian Zimmerman <nobrowser>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	596004
Bug Blocks:

Description Ian Zimmerman 2016-09-12 03:39:11 UTC

According to the RedHat summary [1]:

An out-of-bounds read vulnerability in CopyMagickMemory was found that can lead to memory leak because the read data are written into output image using SetImageProperty or can cause DoS by crashing the application.

Fixed by upstream as in [2], in version 6.9.5-4. The first version available in gentoo above that is 6.9.5-5, still keyworded as unstable.

[1]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6491

[2]
https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b


Reproducible: Always

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2016-10-11 08:39:40 UTC

Verified the source of media-gfx/imagemagick-6.9.5.10, which does contain the appropriate fix.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2016-11-30 21:45:24 UTC

This issue was resolved and addressed in
 GLSA 201611-21 at https://security.gentoo.org/glsa/201611-21
by GLSA coordinator Aaron Bauman (b-man).