Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 629288 (CVE-2017-13736, CVE-2017-13737) - media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,13737})
Summary: media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,...
Status: RESOLVED FIXED
Alias: CVE-2017-13736, CVE-2017-13737
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-29 13:25 UTC by Aleksandr Wagner (Kivak)
Modified: 2020-06-20 01:58 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-08-29 13:25:04 UTC 
CVE-2017-13736 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):

There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484192

CVE-2017-13737 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484196
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2018-03-26 01:05:01 UTC 
(In reply to Aleksandr Wagner (Kivak) from comment #0)
> CVE-2017-13736
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> 
> There are lots of memory leaks in the GMCommand function in magick/command.c
> in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> 

Still trying to track a fix for this

> CVE-2017-13737
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):
> 
> There is an invalid free in the MagickFree function in magick/memory.c in
> GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484196

Fixed in 1.3.27
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-06-15 01:27:30 UTC 
(In reply to Aaron Bauman from comment #1)
> (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > CVE-2017-13736
> > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > 
> > There are lots of memory leaks in the GMCommand function in magick/command.c
> > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > attack. 
> > 
> > References:
> > 
> > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > 
> 
> Still trying to track a fix for this

I can't reproduce on the in-tree version with -fsanitize=address using the POC linked in that Redhat bug.
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-20 01:58:29 UTC 
(In reply to John Helmert III (ajak) from comment #2)
> (In reply to Aaron Bauman from comment #1)
> > (In reply to Aleksandr Wagner (Kivak) from comment #0)
> > > CVE-2017-13736
> > > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> > > 
> > > There are lots of memory leaks in the GMCommand function in magick/command.c
> > > in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> > > attack. 
> > > 
> > > References:
> > > 
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> > > 
> > 
> > Still trying to track a fix for this
> 
> I can't reproduce on the in-tree version with -fsanitize=address using the
> POC linked in that Redhat bug.

There have been a LOT of fuzzing fixes in GM since then. Thanks! Closing.