Bug 1058435 (CVE-2017-14400) - VUL-2: CVE-2017-14400: GraphicsMagick,ImageMagick: PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allowing a possible denial of service
Summary: VUL-2: CVE-2017-14400: GraphicsMagick,ImageMagick: PersistPixelCache function...
Status: RESOLVED WORKSFORME
Alias: CVE-2017-14400
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Petr Gajdos
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/191862/
Whiteboard: CVSSv2:SUSE:CVE-2017-14400:4.3:(AV:N/...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-13 06:44 UTC by Victor Pereira
Modified: 2019-04-23 22:39 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2017-09-13 06:44:42 UTC 
CVE-2017-14400

In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c
mishandles the pixel cache nexus, which allows remote attackers to cause a
denial of service (NULL pointer dereference in the function GetVirtualPixels in
MagickCore/cache.c) via a crafted file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14400
http://www.cvedetails.com/cve/CVE-2017-14400/
https://github.com/ImageMagick/ImageMagick/issues/746
Comment 1 Marcus Meissner 2017-09-29 09:50:22 UTC 
NULL ptr controlled abort. deferable
Comment 2 Petr Gajdos 2018-04-17 10:14:29 UTC 
BEFORE

12/ImageMagick

$ valgrind -q convert im_poc_1505120100 output.mpc
$ valgrind -q convert output.mpc output.uil
$
[no issue]

11/ImageMagick

$ valgrind -q convert im_poc_1505120100 output.mpc
convert: no decode delegate for this image format `im_poc_1505120100'.
convert: missing an image filename `output.mpc'.
$
[testcase not applicable]

11,42.3/GraphicsMagick

$ valgrind -q gm convert im_poc_1505120100 output.mpc
gm convert: Improper image header (im_poc_1505120100).
$
[testcase not applicable (output.mpc not created)]

PATCH

https://github.com/ImageMagick/ImageMagick6/commit/04b863f15effa4375e4ee42f413f0246062b48af

12,11/ImageMagick: no such invalid free in code
11,42.3,HG/GraphicsMagick: no such invalid free in code

No currently maintained code is affected.