Bug 626968 (CVE-2017-11752)

Summary:	<media-gfx/imagemagick-7.0.6.4: ReadMAGICKImage function allows a denial of service (CVE-2017-11752)
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/ImageMagick/ImageMagick/issues/628
Whiteboard:	~3 [noglsa cve]
Package list:		Runtime testing required:	---

Description Aleksandr Wagner (Kivak) 2017-08-03 10:50:19 UTC

CVE-2017-11752 (https://nvd.nist.gov/vuln/detail/CVE-2017-11752):

The ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.

Reference:

https://github.com/ImageMagick/ImageMagick/issues/628

Commit:

https://github.com/ImageMagick/ImageMagick/commit/9eccfd52199616da66c93b6d627d4d4126f5a5f0

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-08-22 20:43:28 UTC

@Security

The bug was already fixed by upstream and tree is clean. The only affected version was non-stable so dropped to ~3, we only need to add CVE.

Thanks

Gentoo Security Padawan
ChrisADR