Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 629288 (CVE-2017-13736, CVE-2017-13737)

Summary: media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,13737})
Product: Gentoo Security Reporter: Aleksandr Wagner (Kivak) <alwag>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: graphics+disabled, jchelmert3
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [upstream cve]
Package list:
Runtime testing required: ---

Description Aleksandr Wagner (Kivak) 2017-08-29 13:25:04 UTC
CVE-2017-13736 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):

There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484192

CVE-2017-13737 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484196
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2018-03-26 01:05:01 UTC
(In reply to Aleksandr Wagner (Kivak) from comment #0)
> CVE-2017-13736
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> 
> There are lots of memory leaks in the GMCommand function in magick/command.c
> in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> 

Still trying to track a fix for this

> CVE-2017-13737
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):
> 
> There is an invalid free in the MagickFree function in magick/memory.c in
> GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484196

Fixed in 1.3.27
Comment 2 John Helmert III (ajak) 2020-06-15 01:27:30 UTC
(In reply to Aaron Bauman from comment #1)
> (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > CVE-2017-13736
> > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > 
> > There are lots of memory leaks in the GMCommand function in magick/command.c
> > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > attack. 
> > 
> > References:
> > 
> > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > 
> 
> Still trying to track a fix for this

I can't reproduce on the in-tree version with -fsanitize=address using the POC linked in that Redhat bug.
Comment 3 Sam James gentoo-dev Security 2020-06-20 01:58:29 UTC
(In reply to John Helmert III (ajak) from comment #2)
> (In reply to Aaron Bauman from comment #1)
> > (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > > CVE-2017-13736
> > > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > > 
> > > There are lots of memory leaks in the GMCommand function in magick/command.c
> > > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > > attack. 
> > > 
> > > References:
> > > 
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > > 
> > 
> > Still trying to track a fix for this
> 
> I can't reproduce on the in-tree version with -fsanitize=address using the
> POC linked in that Redhat bug.

There have been a LOT of fuzzing fixes in GM since then. Thanks! Closing.