Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 626830 (CVE-2017-11753, CVE-2017-11754, CVE-2017-11755) - <media-gfx/imagemagick-7.0.6-4: multiple vulnerabilities
Summary: <media-gfx/imagemagick-7.0.6-4: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2017-11753, CVE-2017-11754, CVE-2017-11755
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/ImageMagick/ImageM...
Whiteboard: ~3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-01 19:06 UTC by Christopher Díaz Riveros (RETIRED)
Modified: 2017-09-17 21:01 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-08-01 19:06:26 UTC
From URL:

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4
allows remote attackers to cause a denial of service (memory leak) via
a crafted file that is mishandled in an AcquireSemaphoreInfo call.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-08-01 19:12:26 UTC
For CVE-2017-11755:

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4
allows remote attackers to cause a denial of service (memory leak) via
a crafted file that is mishandled in an AcquireSemaphoreInfo call.

Upstream bug:

https://github.com/ImageMagick/ImageMagick/issues/634

-------------------------------------------------------------------

For CVE-2017-11754:

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4
allows remote attackers to cause a denial of service (memory leak) via
a crafted file that is mishandled in an OpenPixelCache call.

Upstream bug:

https://github.com/ImageMagick/ImageMagick/issues/633

-------------------------------------------------------------------

For CVE-2017-11753:

The GetImageDepth function in MagickCore/attribute.c in ImageMagick
7.0.6-4 might allow remote attackers to cause a denial of service
(heap-based buffer over-read) via a crafted Flexible Image Transport
System (FITS) file.

Upstream bug:

https://github.com/ImageMagick/ImageMagick/issues/629

Gentoo Security Padawan
ChrisADR
Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-08-22 20:44:36 UTC
@Security

The bug was already fixed by upstream and tree is clean. The only affected version was non-stable so dropped to ~3, we only need to add CVE.

Thanks

Gentoo Security Padawan
ChrisADR