Imagemagick 'gif.c' Memory Corruption Vulnerability

Bugtraq ID:	62080
Class:	Boundary Condition Error
CVE:	CVE-2013-4298
Remote:	Yes
Local:	No
Published:	Aug 29 2013 12:00AM
Updated:	May 19 2014 05:54AM
Credit:	Anton Kortunov
Vulnerable:	ImageMagick ImageMagick 6.4 -4 ImageMagick ImageMagick 6.3.4 ImageMagick ImageMagick 6.2.9 ImageMagick ImageMagick 6.2.8 ImageMagick ImageMagick 6.2.7 ImageMagick ImageMagick 6.2.6 ImageMagick ImageMagick 6.2.5 ImageMagick ImageMagick 6.2.4 .5 ImageMagick ImageMagick 6.2.4 ImageMagick ImageMagick 6.2.3 ImageMagick ImageMagick 6.2.2 + Gentoo Linux ImageMagick ImageMagick 6.2.1 ImageMagick ImageMagick 6.2 .0.7 + Red Hat Fedora Core3 + Red Hat Fedora Core2 ImageMagick ImageMagick 6.2 .0.4 + Gentoo Linux ImageMagick ImageMagick 6.2 ImageMagick ImageMagick 6.1.8 + Gentoo Linux ImageMagick ImageMagick 6.1.7 ImageMagick ImageMagick 6.1.6 ImageMagick ImageMagick 6.1.5 ImageMagick ImageMagick 6.1.4 ImageMagick ImageMagick 6.1.3 ImageMagick ImageMagick 6.1.2 ImageMagick ImageMagick 6.1.1 ImageMagick ImageMagick 6.1 ImageMagick ImageMagick 6.0.8 ImageMagick ImageMagick 6.0.7 + Red Hat Enterprise Linux AS 4 + RedHat Desktop 4.0 + RedHat Enterprise Linux Desktop version 4 + RedHat Enterprise Linux ES 4 + RedHat Enterprise Linux WS 4 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 ImageMagick ImageMagick 6.0.6 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 ImageMagick ImageMagick 6.0.5 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 ImageMagick ImageMagick 6.0.4 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 ImageMagick ImageMagick 6.0.3 ImageMagick ImageMagick 6.0.2 .5 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 ImageMagick ImageMagick 6.0.2 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 ImageMagick ImageMagick 6.0.1 ImageMagick ImageMagick 6.0 ImageMagick ImageMagick 5.5.7 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 ImageMagick ImageMagick 5.5.6 + Red Hat Enterprise Linux AS 3 + RedHat Desktop 3.0 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux WS 3 ImageMagick ImageMagick 5.5.4 + S.u.S.E. Linux Personal 8.2 ImageMagick ImageMagick 5.4.8 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 ImageMagick ImageMagick 5.4.7 + Turbolinux Turbolinux Server 8.0 ImageMagick ImageMagick 5.4.4 .5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 ImageMagick ImageMagick 5.4.3 + Turbolinux Turbolinux Workstation 8.0 ImageMagick ImageMagick 5.3.8 + Red Hat Enterprise Linux AS 2.1 IA64 + Red Hat Enterprise Linux AS 2.1 + RedHat Enterprise Linux ES 2.1 IA64 + RedHat Enterprise Linux ES 2.1 + RedHat Enterprise Linux WS 2.1 IA64 + RedHat Enterprise Linux WS 2.1 ImageMagick ImageMagick 5.3.3 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0 ImageMagick ImageMagick 6.7.6-4 ImageMagick ImageMagick 6.7.6-2 ImageMagick ImageMagick 6.7.5-1 ImageMagick ImageMagick 6.6.8-5 ImageMagick ImageMagick 6.6.5-5 ImageMagick ImageMagick 6.5.2-9 ImageMagick ImageMagick 6.5.2-8 ImageMagick ImageMagick 6.3.5-9 ImageMagick ImageMagick 6.3.5-10 ImageMagick ImageMagick 6.3.3-6 ImageMagick ImageMagick 6.3.3-5 ImageMagick ImageMagick 6.3.3-3 ImageMagick ImageMagick 6.3.2 ImageMagick ImageMagick 6.3.1 ImageMagick ImageMagick 6.2.9.2 ImageMagick ImageMagick 6.2.4.3 ImageMagick ImageMagick 6.2.3.4 ImageMagick ImageMagick 6.2.0.3 ImageMagick ImageMagick 6.0.6.2 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 ImageMagick ImageMagick 6.0.4.4 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 ImageMagick ImageMagick 5.5.7.15 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 ImageMagick ImageMagick 5.4.2.3 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Imagemagick 'gif.c' Memory Corruption Vulnerability

Imagemagick is prone to a remote memory-corruption vulnerability because it fails to sufficiently bounds-check user supplied data.

An attacker could exploit this issue to corrupt memory, execute arbitrary code or cause denial-of-service conditions.

Versions prior to imagemagick 6.7.8-8 are vulnerable.

Imagemagick 'gif.c' Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Imagemagick 'gif.c' Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Imagemagick 'gif.c' Memory Corruption Vulnerability

References:

• ImageMagick Homepage (ImageMagick)