Bug 629904 (CVE-2017-14103)

Summary:	<media-gfx/graphicsmagick-1.3.27: use-after-free attacks via a crafted file (CVE-2017-14103)
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---

Description Aleksandr Wagner (Kivak) 2017-09-04 18:33:35 UTC

CVE-2017-14103 (https://nvd.nist.gov/vuln/detail/CVE-2017-14103):

The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403.

References:

http://hg.code.sf.net/p/graphicsmagick/code/rev/98721124e51f
https://blogs.gentoo.org/ago/2017/09/01/graphicsmagick-use-after-free-in-closeblob-blob-c-incomplete-fix-for-cve-2017-11403/
https://sourceforge.net/p/graphicsmagick/bugs/440/

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:11:04 UTC

@maintainer(s), please clean the vulnerable version from the tree.

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:41:28 UTC

cleanup will be tracked in bug #640690

GLSA Vote: No