Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 626968 (CVE-2017-11752) - <media-gfx/imagemagick-7.0.6.4: ReadMAGICKImage function allows a denial of service (CVE-2017-11752)
Summary: <media-gfx/imagemagick-7.0.6.4: ReadMAGICKImage function allows a denial of s...
Status: RESOLVED FIXED
Alias: CVE-2017-11752
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://github.com/ImageMagick/ImageM...
Whiteboard: ~3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-03 10:50 UTC by Aleksandr Wagner (Kivak)
Modified: 2017-08-24 01:13 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-08-03 10:50:19 UTC 
CVE-2017-11752 (https://nvd.nist.gov/vuln/detail/CVE-2017-11752):

The ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.

Reference:

https://github.com/ImageMagick/ImageMagick/issues/628

Commit:

https://github.com/ImageMagick/ImageMagick/commit/9eccfd52199616da66c93b6d627d4d4126f5a5f0
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-08-22 20:43:28 UTC 
@Security

The bug was already fixed by upstream and tree is clean. The only affected version was non-stable so dropped to ~3, we only need to add CVE.

Thanks

Gentoo Security Padawan
ChrisADR