Bug 636740 (CVE-2017-16547)

Summary:	<media-gfx/graphicsmagick-1.3.27: DrawImage function in magick/render.c allows remote DoS
Product:	Gentoo Security	Reporter:	D'juan McDonald (domhnall) <flopwiki>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://hg.code.sf.net/p/graphicsmagick/code/rev/785758bbbfcc
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---

Description D'juan McDonald (domhnall) 2017-11-06 20:24:30 UTC

CVE-2017-16547(https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16547):
The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file.

@maintainer(s), after bump, please call for stabilization when ready, thank you.

Gentoo Security Padawan
(jmbailey/mbailey_j)

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:33:03 UTC

@maintainer(s), please clean the vulnerable version from the tree.

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-03-26 01:46:51 UTC

cleanup will be tracked in bug #640690

GLSA Vote: No