Bug 593526 – <media-gfx/imagemagick-6.9.5.3: Out-of-bounds read when processing crafted tiff file (CVE-2016-5010)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Ian Zimmerman 2016-09-12 03:17:13 UTC]

According to the RedHat summary [1]:

An out-of-bounds heap read vulnerability in ImageMagick compiled with TIFF support that can be triggered by running mogrify on crafted TIFF file was found.

Fixed by upstream in ImageMagick 6.9.5-3.  The next version above available in portage is 6.9.5-5 but that is still keyworded as unstable.

[1]

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5010

[Comment 1 Aaron Bauman (RETIRED) 2016-10-11 08:12:00 UTC]

(In reply to behemothchess from comment #0)
> According to the RedHat summary [1]:
> 
> An out-of-bounds heap read vulnerability in ImageMagick compiled with TIFF
> support that can be triggered by running mogrify on crafted TIFF file was
> found.
> 
> Fixed by upstream in ImageMagick 6.9.5-3.  The next version above available
> in portage is 6.9.5-5 but that is still keyworded as unstable.
> 
> [1]
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5010

Thank you for the report!

[Comment 2 GLSAMaker/CVETool Bot 2016-11-01 12:56:09 UTC]

CVE-2016-5010 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5010):
  ** RESERVED ** This candidate has been reserved by an organization or
  individual that will use it when announcing a new security problem. When the
  candidate has been publicized, the details for this candidate will be
  provided.

[Comment 3 GLSAMaker/CVETool Bot 2016-11-30 21:45:09 UTC]

This issue was resolved and addressed in
 GLSA 201611-21 at https://security.gentoo.org/glsa/201611-21
by GLSA coordinator Aaron Bauman (b-man).