Bug 1057157 (CVE-2017-14138)

Summary: VUL-1: CVE-2017-14138: ImageMagick: memory leak vulnerability in ReadWEBPImage in coders/webp.c
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: astieger, meissner, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/191435/
Whiteboard: CVSSv2:SUSE:CVE-2017-14138:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3:SUSE:CVE-2017-14138:5.3:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVSSv3:RedHat:CVE-2017-14138:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv3:NVD:CVE-2017-14138:9.8:(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2017-09-05 07:32:47 UTC
CVE-2017-14138

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in
coders/webp.c because memory is not freed in certain error cases, as
demonstrated by VP8 errors.

Upstream bug:
https://github.com/ImageMagick/ImageMagick/issues/639

Upstream fix:
https://github.com/ImageMagick/ImageMagick/commit/def00c720dffb57a821bd8acd77eac7b10a0568b
https://github.com/ImageMagick/ImageMagick/commit/1c487cd945996a77ba611b83dc6a2ceedb89be3d

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14138
http://www.cvedetails.com/cve/CVE-2017-14138/
Comment 1 Marcus Meissner 2017-09-25 15:54:28 UTC
memory leak is source data sized, so is attacker controlled.
Comment 2 Petr Gajdos 2017-11-07 09:12:13 UTC
(In reply to Alexander Bergmann from comment #0)
> https://github.com/ImageMagick/ImageMagick/commit/
> 1c487cd945996a77ba611b83dc6a2ceedb89be3d

No, even if this is tagged as fix for upstream issue #639, it is followup to fix of the bug #641. See bug #1057153 for details.
Comment 3 Petr Gajdos 2017-11-07 09:56:26 UTC
Testcase does not work for me in 12/ImageMagick.

$ valgrind --tool=memcheck --leak-check=full --read-var-info=yes --error-exitcode=2 --track-origins=yes --num-callers=12 --quiet identify leak-ReadWEBPImage 
identify: corrupt image `leak-ReadWEBPImage' @ error/webp.c/ReadWEBPImage/293.
$
Comment 4 Petr Gajdos 2017-11-07 09:58:09 UTC
Neither valgrind detects an error in 43.3/GraphicsMagick.
Comment 5 Petr Gajdos 2017-11-07 10:09:58 UTC
11/GraphicsMagick and 11/ImageMagick does not have webp.c.
Comment 6 Petr Gajdos 2017-11-07 15:37:25 UTC
42.3/GraphicsMagick and 42.2/GraphicsMagick is not affected.
Comment 7 Petr Gajdos 2017-11-07 15:38:13 UTC
Submitting for: 12/ImageMagick
Comment 8 Petr Gajdos 2017-11-07 15:58:37 UTC
I believe all fixed.
Comment 11 Swamp Workflow Management 2017-12-20 17:38:44 UTC
SUSE-SU-2017:3388-1: An update that solves 32 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1048457,1049796,1050083,1050116,1050139,1050632,1051441,1051847,1052450,1052553,1052689,1052744,1052758,1052764,1054757,1055214,1056432,1057157,1057719,1057729,1057730,1058485,1058637,1059666,1059778,1060176,1060577,1061254,1062750,1066003,1067181,1067184,1067409
CVE References: CVE-2017-11188,CVE-2017-11478,CVE-2017-11523,CVE-2017-11527,CVE-2017-11535,CVE-2017-11640,CVE-2017-11752,CVE-2017-12140,CVE-2017-12435,CVE-2017-12587,CVE-2017-12644,CVE-2017-12662,CVE-2017-12669,CVE-2017-12983,CVE-2017-13134,CVE-2017-13769,CVE-2017-14138,CVE-2017-14172,CVE-2017-14173,CVE-2017-14175,CVE-2017-14341,CVE-2017-14342,CVE-2017-14531,CVE-2017-14607,CVE-2017-14682,CVE-2017-14733,CVE-2017-14989,CVE-2017-15217,CVE-2017-15930,CVE-2017-16545,CVE-2017-16546,CVE-2017-16669
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.17.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.17.1
Comment 12 Andreas Stieger 2017-12-22 15:55:26 UTC
done
Comment 13 Swamp Workflow Management 2017-12-22 20:14:24 UTC
openSUSE-SU-2017:3420-1: An update that solves 32 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1048457,1049796,1050083,1050116,1050139,1050632,1051441,1051847,1052450,1052553,1052689,1052744,1052758,1052764,1054757,1055214,1056432,1057157,1057719,1057729,1057730,1058485,1058637,1059666,1059778,1060176,1060577,1061254,1062750,1066003,1067181,1067184,1067409
CVE References: CVE-2017-11188,CVE-2017-11478,CVE-2017-11523,CVE-2017-11527,CVE-2017-11535,CVE-2017-11640,CVE-2017-11752,CVE-2017-12140,CVE-2017-12435,CVE-2017-12587,CVE-2017-12644,CVE-2017-12662,CVE-2017-12669,CVE-2017-12983,CVE-2017-13134,CVE-2017-13769,CVE-2017-14138,CVE-2017-14172,CVE-2017-14173,CVE-2017-14175,CVE-2017-14341,CVE-2017-14342,CVE-2017-14531,CVE-2017-14607,CVE-2017-14682,CVE-2017-14733,CVE-2017-14989,CVE-2017-15217,CVE-2017-15930,CVE-2017-16545,CVE-2017-16546,CVE-2017-16669
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-40.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.12.1