[ImageMagick] security issues with releases prior to 6.3.5-9
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
graphicsmagick (Debian) |
Fix Released
|
Unknown
|
|||
graphicsmagick (Gentoo Linux) |
Fix Released
|
High
|
|||
graphicsmagick (Ubuntu) |
Fix Released
|
Medium
|
William Grant | ||
Dapper |
Won't Fix
|
Medium
|
Unassigned | ||
Edgy |
Won't Fix
|
Medium
|
Unassigned | ||
Feisty |
Won't Fix
|
Medium
|
Unassigned | ||
Gutsy |
Won't Fix
|
Medium
|
Unassigned | ||
imagemagick (Ubuntu) |
Fix Released
|
Medium
|
Kees Cook | ||
Dapper |
Fix Released
|
Medium
|
Kees Cook | ||
Edgy |
Fix Released
|
Medium
|
Kees Cook | ||
Feisty |
Fix Released
|
Medium
|
Kees Cook | ||
Gutsy |
Fix Released
|
Medium
|
Kees Cook |
Bug Description
Binary package hint: imagemagick
From:
http://
"iDefense is planning to announce a number of security issues with
ImageMagick in releases prior to 6.3.5-9. All known security issues
are resolved with the recent release of 6.3.5-9. The issues are
predominately data driven integer overflow that potentially cause less
memory to be allocated than required. We have addressed this security
flaw by introducing the AcquireQuantumM
element count and size. If `count' times `size' overflow (i.e. result
greater than 4GB), we return an error. Note that there are no known
exploits for these issues but you might want to consider upgrading if
you can or to apply patches against any older versions of ImageMagick
you might be using."
References:
- Multiple Vendor ImageMagick Multiple Integer Overflow Vulnerabilities
http://
- Multiple Vendor ImageMagick Off-By-One Vulnerability
http://
- Multiple Vendor ImageMagick Multiple Denial of Service Vulnerabilities
http://
- Multiple Vendor ImageMagick Sign Extension Vulnerability
http://
description: | updated |
Changed in graphicsmagick: | |
assignee: | nobody → keescook |
importance: | Undecided → Medium |
status: | New → In Progress |
assignee: | nobody → keescook |
importance: | Undecided → Medium |
status: | New → In Progress |
assignee: | nobody → keescook |
importance: | Undecided → Medium |
status: | New → In Progress |
importance: | Undecided → Medium |
status: | New → Confirmed |
assignee: | keescook → nobody |
status: | In Progress → Confirmed |
Changed in graphicsmagick: | |
status: | Unknown → New |
Changed in graphicsmagick: | |
status: | New → Fix Released |
Changed in graphicsmagick: | |
status: | Unknown → Fix Released |
Changed in graphicsmagick: | |
status: | In Progress → Fix Released |
Changed in graphicsmagick (Gentoo Linux): | |
importance: | Unknown → High |
imagemagick 6.3.5 has been released on July 5th, with a -2 patch version on the 17th. The reason I am mentioning it is that I got a huge memory leak when using imagemagick 6.3.4 through rmagick 1.15.7-r1. Both imagemagick 6.3.3 and 6.3.5 don't have this problem.
Since things work again with imagemagick 6.3.5 I'm not going to hunt for the actual cause, but let me know if you need more information.