bugtraq - [ MDVSA-2012:077 ] imagemagick

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1SV0fV-0006wi-DC@titan.mandriva.com>
Date: Thu, 17 May 2012 15:23:01 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2012:077 ] imagemagick

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:077
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : imagemagick
 Date    : May 17, 2012
 Affected: 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in imagemagick:
 
 Untrusted search path vulnerability in configure.c in ImageMagick
 before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows
 local users to gain privileges via a Trojan horse configuration file
 in the current working directory (CVE-2010-4167).
 
 A flaw was found in the way ImageMagick processed images with malformed
 Exchangeable image file format (Exif) metadata. An attacker could
 create a specially-crafted image file that, when opened by a victim,
 would cause ImageMagick to crash or, potentially, execute arbitrary
 code (CVE-2012-0247).
 
 A denial of service flaw was found in the way ImageMagick processed
 images with malformed Exif metadata. An attacker could create a
 specially-crafted image file that, when opened by a victim, could
 cause ImageMagick to enter an infinite loop (CVE-2012-0248).
 
 The original fix for CVE-2012-0247 failed to check for the possibility
 of an integer overflow when computing the sum of number_bytes and
 offset. This resulted in a wrap around into a value smaller than
 length, making original CVE-2012-0247 introduced length check still
 to be possible to bypass, leading to memory corruption (CVE-2012-1185).
 
 An integer overflow flaw was found in the way ImageMagick processed
 certain Exif tags with a large components count. An attacker
 could create a specially-crafted image file that, when opened by a
 victim, could cause ImageMagick to access invalid memory and crash
 (CVE-2012-0259).
 
 A denial of service flaw was found in the way ImageMagick decoded
 certain JPEG images. A remote attacker could provide a JPEG image with
 specially-crafted sequences of RST0 up to RST7 restart markers (used
 to indicate the input stream to be corrupted), which once processed
 by ImageMagick, would cause it to consume excessive amounts of memory
 and CPU time (CVE-2012-0260).
 
 An out-of-bounds buffer read flaw was found in the way ImageMagick
 processed certain TIFF image files. A remote attacker could provide
 a TIFF image with a specially-crafted Exif IFD value (the set of tags
 for recording Exif-specific attribute information), which once opened
 by ImageMagick, would cause it to crash (CVE-2012-1798).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4167
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0247
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0248
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1185
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0259
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0260
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1798
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 4ff09ac510c672499ee00a416edfc2db  2010.1/i586/imagemagick-6.6.1.5-2.1mdv2010.2.i586.rpm
 7373862037711c4b07776f34ff3f4be0  2010.1/i586/imagemagick-desktop-6.6.1.5-2.1mdv2010.2.i586.rpm
 8b6a91e231b75db0c0c621649f88290f  2010.1/i586/imagemagick-doc-6.6.1.5-2.1mdv2010.2.i586.rpm
 f0b6618f6538194cf7052214d68e2871  2010.1/i586/libmagick3-6.6.1.5-2.1mdv2010.2.i586.rpm
 a520984667c9e98de7652fe597cd193d  2010.1/i586/libmagick-devel-6.6.1.5-2.1mdv2010.2.i586.rpm
 7c21957250e196d6a539edfff75ef105  2010.1/i586/perl-Image-Magick-6.6.1.5-2.1mdv2010.2.i586.rpm 
 56aa3fca43507cbdb5fe248c9314d860  2010.1/SRPMS/imagemagick-6.6.1.5-2.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 2409ce33960122226551d2becad53fca  2010.1/x86_64/imagemagick-6.6.1.5-2.1mdv2010.2.x86_64.rpm
 93c7a6840fdc4886239e00b6d4e83098  2010.1/x86_64/imagemagick-desktop-6.6.1.5-2.1mdv2010.2.x86_64.rpm
 32896b93d2bd840d8656a04876236a51  2010.1/x86_64/imagemagick-doc-6.6.1.5-2.1mdv2010.2.x86_64.rpm
 e6f4557debbd9cfc3e44d81be6536075  2010.1/x86_64/lib64magick3-6.6.1.5-2.1mdv2010.2.x86_64.rpm
 4386810c4640ea9e3561d196f0d00ff2  2010.1/x86_64/lib64magick-devel-6.6.1.5-2.1mdv2010.2.x86_64.rpm
 6cde8d3590fc4a3f1e6cf74d8c42c7ed  2010.1/x86_64/perl-Image-Magick-6.6.1.5-2.1mdv2010.2.x86_64.rpm 
 56aa3fca43507cbdb5fe248c9314d860  2010.1/SRPMS/imagemagick-6.6.1.5-2.1mdv2010.2.src.rpm

 Mandriva Enterprise Server 5:
 74c481999cfa56013ef04ffba6fc5945  mes5/i586/imagemagick-6.4.2.10-5.3mdvmes5.2.i586.rpm
 2b591de902a76d961e483ad447e299b9  mes5/i586/imagemagick-desktop-6.4.2.10-5.3mdvmes5.2.i586.rpm
 b3353d5b6ac13de56b299dbd1dc1f1d7  mes5/i586/imagemagick-doc-6.4.2.10-5.3mdvmes5.2.i586.rpm
 a5be187b2d15e57068717be451dbeedd  mes5/i586/libmagick1-6.4.2.10-5.3mdvmes5.2.i586.rpm
 fd04200438ae525dbd594ef8adf74150  mes5/i586/libmagick-devel-6.4.2.10-5.3mdvmes5.2.i586.rpm
 12bc440241c35517d681c316e426a55d  mes5/i586/perl-Image-Magick-6.4.2.10-5.3mdvmes5.2.i586.rpm 
 25c05027ec8e9122a9fe18b14d949ebe  mes5/SRPMS/imagemagick-6.4.2.10-5.3mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 81b69f7bb9d3e4237a426cae23e21970  mes5/x86_64/imagemagick-6.4.2.10-5.3mdvmes5.2.x86_64.rpm
 a97f42e2875a0ebc3bc487c657eda457  mes5/x86_64/imagemagick-desktop-6.4.2.10-5.3mdvmes5.2.x86_64.rpm
 92d5364d9e74c865fdfb91643247f8c9  mes5/x86_64/imagemagick-doc-6.4.2.10-5.3mdvmes5.2.x86_64.rpm
 b100d380eb002a3244e1ee661b1633f5  mes5/x86_64/lib64magick1-6.4.2.10-5.3mdvmes5.2.x86_64.rpm
 d3b569df24eeae5ad3d0c7119e91df8a  mes5/x86_64/lib64magick-devel-6.4.2.10-5.3mdvmes5.2.x86_64.rpm
 2f3012e2b94ae58b6bdcf513afbda0ae  mes5/x86_64/perl-Image-Magick-6.4.2.10-5.3mdvmes5.2.x86_64.rpm 
 25c05027ec8e9122a9fe18b14d949ebe  mes5/SRPMS/imagemagick-6.4.2.10-5.3mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPtM6RmqjQ0CJFipgRAtLcAJ0eCJy5lHqxUtx8HGiXR39Nc9w70QCfU3NR
aMRrLfbQbqenE7QZQBGaC6s=
=fXtt
-----END PGP SIGNATURE-----