GraphicsMagick CVE-2017-16669 Heap Buffer Overflow Vulnerability

Bugtraq ID:	101795
Class:	Boundary Condition Error
CVE:	CVE-2017-16669
Remote:	Yes
Local:	No
Published:	Nov 08 2017 12:00AM
Updated:	Dec 19 2017 10:00PM
Credit:	The vendor reported this issue.
Vulnerable:	GraphicsMagick GraphicsMagick 1.3.26
Not Vulnerable:

GraphicsMagick CVE-2017-16669 Heap Buffer Overflow Vulnerability

GraphicsMagick is prone to a heap-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successful exploits may allow the attacker to crash the affected application. Due to the nature of this issue, code execution may be possible but this has not been confirmed.

GraphicsMagick version 1.3.26 is vulnerable; other versions may also be affected.

GraphicsMagick CVE-2017-16669 Heap Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GraphicsMagick CVE-2017-16669 Heap Buffer Overflow Vulnerability

References:

• #450 Heap buffer overflow in AcquireCacheNexus() (sourceforge.net)
  
• * coders/wpg.c Check for InsertRow() return value. (hg.code.sf.net)
  
• * coders/wpg.c Wrong MaxMap check condition - fixed. (hg.code.sf.net)
  
• coders/wpg.c: Wrong row count checking. (hg.code.sf.net)
  
• Do not call SyncImagePixels() when something fails. (hg.code.sf.net)
  
• GraphicsMagick Homepage (GraphicsMagick)
  
• import.c/export.c detect pending use of null indexes pointer due to programming (hg.code.sf.net)
  
• WPG: Assure that colormapped image is a PseudoClass type with valid colormapped (hg.code.sf.net)
  
• WPG: Fix crash which image fails to produce expected PseudoClass indexes. (hg.code.sf.net)