Bug 636676 (CVE-2017-16545)

Summary:	<media-gfx/graphicsmagick-1.3.27: Invalid colormapped index in ReadWPGImage() in coders/wpg.c
Product:	Gentoo Security	Reporter:	D'juan McDonald (domhnall) <flopwiki>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086faa52d0
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---

Description D'juan McDonald (domhnall) 2017-11-06 00:22:04 UTC

CVE-2017-16545(https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16545):

The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image.






@maintainer(s), after bump, please call stabilization when ready, thank you.

Gentoo Security Padawan
(jmbailey/mbailey_j)

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:30:43 UTC

@maintainer(s), please clean the vulnerable version from the tree.

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:46:30 UTC

cleanup will be tracked in bug #640690

GLSA Vote: No