ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
BID:13100
Info
ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
| Bugtraq ID: | 13100 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 11 2005 12:00AM |
| Updated: | Apr 11 2005 12:00AM |
| Credit: | These issues were reported by Bruno Rohee. |
| Vulnerable: |
ImageMagick ImageMagick 6.2 .0.7 ImageMagick ImageMagick 6.2 .0.4 ImageMagick ImageMagick 6.2 ImageMagick ImageMagick 6.1.8 ImageMagick ImageMagick 6.1.7 ImageMagick ImageMagick 6.1.6 ImageMagick ImageMagick 6.1.5 ImageMagick ImageMagick 6.1.4 ImageMagick ImageMagick 6.1.3 ImageMagick ImageMagick 6.1.2 ImageMagick ImageMagick 6.1.1 ImageMagick ImageMagick 6.1 ImageMagick ImageMagick 6.0.8 ImageMagick ImageMagick 6.0.7 ImageMagick ImageMagick 6.0.6 ImageMagick ImageMagick 6.0.5 ImageMagick ImageMagick 6.0.4 ImageMagick ImageMagick 6.0.3 ImageMagick ImageMagick 6.0.2 .5 ImageMagick ImageMagick 6.0.2 ImageMagick ImageMagick 6.0.1 ImageMagick ImageMagick 6.0 ImageMagick ImageMagick 5.5.7 ImageMagick ImageMagick 5.5.6 .0-20030409 ImageMagick ImageMagick 5.5.6 ImageMagick ImageMagick 5.5.4 ImageMagick ImageMagick 5.5.3 .2-1.2.0 ImageMagick ImageMagick 5.4.8 .2-1.1.0 ImageMagick ImageMagick 5.4.8 ImageMagick ImageMagick 5.4.7 ImageMagick ImageMagick 5.4.4 .5 ImageMagick ImageMagick 5.4.3 ImageMagick ImageMagick 5.3.8 ImageMagick ImageMagick 5.3.3 |
| Not Vulnerable: | |
Discussion
ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
ImageMagick is reported prone to multiple unspecified heap memory corruption vulnerabilities. It is reported that these issues are caused by a lack of sufficient sanity checks performed while allocating heap-based memory when the chunk size is derived from the image height, width and plane values.
It is reported that a malicious image may be used to trigger these issues.
A remote attacker may potentially exploit these vulnerabilities to crash affected software, or to potentially execute arbitrary code in the context of the user that is running the affected software, although this is not confirmed.
This BID will be updated and split into unique BIDs as soon as further information is available.
ImageMagick is reported prone to multiple unspecified heap memory corruption vulnerabilities. It is reported that these issues are caused by a lack of sufficient sanity checks performed while allocating heap-based memory when the chunk size is derived from the image height, width and plane values.
It is reported that a malicious image may be used to trigger these issues.
A remote attacker may potentially exploit these vulnerabilities to crash affected software, or to potentially execute arbitrary code in the context of the user that is running the affected software, although this is not confirmed.
This BID will be updated and split into unique BIDs as soon as further information is available.
Exploit / POC
ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
ImageMagick Multiple Unspecified Image Handling Heap-Based Memory Corruption Vulnerabilities
References:
References:
- ImageMagick Homepage (ImageMagick)
- XV multiple buffer overflows (update) (Greg Roelofs