Bug 844157 (CVE-2013-4298) - VUL-0: CVE-2013-4298: ImageMagick/GraphicsMagick: overflow in GIF encoder
Summary: VUL-0: CVE-2013-4298: ImageMagick/GraphicsMagick: overflow in GIF encoder
Status: RESOLVED INVALID
Alias: CVE-2013-4298
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Petr Gajdos
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-04 21:49 UTC by Marcus Meissner
Modified: 2013-10-16 15:20 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
metal.gif (59.16 KB, image/gif)
2013-10-16 15:15 UTC, Marcus Meissner 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-10-04 21:49:43 UTC 
CVE-2013-4298

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows
remote attackers to cause a denial of service (memory corruption and application
crash) via a crafted comment in a GIF image.

References:
http://www.ubuntu.com/usn/USN-1949-1
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721273
http://secunia.com/advisories/54581
http://secunia.com/advisories/54671
http://www.debian.org/security/2013/dsa-2750
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4298
https://bugzilla.redhat.com/show_bug.cgi?id=1004648
Comment 1 Swamp Workflow Management 2013-10-04 22:00:32 UTC 
bugbot adjusting priority
Comment 2 Petr Gajdos 2013-10-15 14:38:17 UTC 
Reproducible with pure 

identify metal.gif 

or

identify water.gif

for ImageMagick 6.7.8-7. Test cases are taken from image magick bug referenced above.
Comment 3 Petr Gajdos 2013-10-15 14:41:30 UTC 
ImageMagick: Tested on 12.3 (6.7.8-8), 12.2 (6.7.6-9), 11 (6.4.3-6), 10sp3 (6.2.5-5) and 9sp3 (5.5.7-16), none of them evince this behavior.
Comment 4 Petr Gajdos 2013-10-16 06:46:52 UTC 
GraphicsMagick: tested for factory, 12.3, 12.2 and 11, haven't seen any problem either.

I would suggest to close this, what do you think?
Comment 5 Marcus Meissner 2013-10-16 15:15:06 UTC 
Created attachment 563734 [details]
metal.gif

metal.gif reproducer image
Comment 6 Marcus Meissner 2013-10-16 15:20:38 UTC 
Introduced on May 20th 2012 by

http://trac.imagemagick.org/changeset/8002/ImageMagick/trunk/coders/gif.c

and fixed on July 31 2012 by
http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c

So SLE is not affected, and also our openSUSE did not seem to have got the affected versions.

thanks for verification petr!