Bug 629288 (CVE-2017-13736, CVE-2017-13737)

Summary:	media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,13737})
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	ajak, graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [upstream cve]
Package list:		Runtime testing required:	---

Description Aleksandr Wagner (Kivak) 2017-08-29 13:25:04 UTC

CVE-2017-13736 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):

There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484192

CVE-2017-13737 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484196

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:05:01 UTC

(In reply to Aleksandr Wagner (Kivak) from comment #0)
> CVE-2017-13736
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> 
> There are lots of memory leaks in the GMCommand function in magick/command.c
> in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> 

Still trying to track a fix for this

> CVE-2017-13737
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):
> 
> There is an invalid free in the MagickFree function in magick/memory.c in
> GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484196

Fixed in 1.3.27

Comment 2 John Helmert III archtester

2020-06-15 01:27:30 UTC

(In reply to Aaron Bauman from comment #1)
> (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > CVE-2017-13736
> > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > 
> > There are lots of memory leaks in the GMCommand function in magick/command.c
> > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > attack. 
> > 
> > References:
> > 
> > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > 
> 
> Still trying to track a fix for this

I can't reproduce on the in-tree version with -fsanitize=address using the POC linked in that Redhat bug.

Comment 3 Sam James archtester

2020-06-20 01:58:29 UTC

(In reply to John Helmert III (ajak) from comment #2)
> (In reply to Aaron Bauman from comment #1)
> > (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > > CVE-2017-13736
> > > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > > 
> > > There are lots of memory leaks in the GMCommand function in magick/command.c
> > > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > > attack. 
> > > 
> > > References:
> > > 
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > > 
> > 
> > Still trying to track a fix for this
> 
> I can't reproduce on the in-tree version with -fsanitize=address using the
> POC linked in that Redhat bug.

There have been a LOT of fuzzing fixes in GM since then. Thanks! Closing.