Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 629288 (CVE-2017-13736, CVE-2017-13737) - media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,13737})
Summary: media-gfx/graphicsmagick: denial of service vulnerabilities (CVE-2017-{13736,...
Status: CONFIRMED
Alias: CVE-2017-13736, CVE-2017-13737
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-29 13:25 UTC by Aleksandr Wagner (Kivak)
Modified: 2018-03-26 01:05 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-08-29 13:25:04 UTC
CVE-2017-13736 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):

There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484192

CVE-2017-13737 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):

There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1484196
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2018-03-26 01:05:01 UTC
(In reply to Aleksandr Wagner (Kivak) from comment #0)
> CVE-2017-13736
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13736):
> 
> There are lots of memory leaks in the GMCommand function in magick/command.c
> in GraphicsMagick 1.3.26 that will lead to a remote denial of service
> attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484192
> 

Still trying to track a fix for this

> CVE-2017-13737
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13737):
> 
> There is an invalid free in the MagickFree function in magick/memory.c in
> GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. 
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1484196

Fixed in 1.3.27