GraphicsMagick Heap-Based Buffer Overflow Vulnerability
Summary
DLA-1159-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u13. Fixed in 1.3.16-1.1+deb7u13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphicsMagick is an open-source collection of image processing tools. It provides a versatile set of functionalities for creating, editing, and converting images. However, a vulnerability has been discovered in GraphicsMagick that allows for a heap-based buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2017-16352, exists in the Display visual image directory feature of the DescribeImage() function in the magick/describe.c file. By running the identify command on a specially crafted MIFF format file with the verbose flag, an attacker can trigger a heap-based buffer overflow. This can potentially lead to arbitrary code execution or a denial of service attack. Another vulnerability, CVE-2017-16353, involves a memory information disclosure in the DescribeImage function of the magick/describe.c file. This vulnerability allows an attacker to obtain sensitive information from the image's IPTC Profile by exploiting a heap-based buffer over-read.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the provided fix by upgrading the GraphicsMagick package.
Conclusion
GraphicsMagick is susceptible to a heap-based buffer overflow and a memory information disclosure vulnerability. To mitigate these risks, it is crucial to upgrade the GraphicsMagick package to the recommended version. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
GraphicsMagick is an open-source collection of image processing tools that allows for creating, editing, and converting images.
A heap-based buffer overflow occurs when a program writes more data to a buffer in the heap than it can hold, leading to memory corruption and potential security vulnerabilities.
An attacker can exploit these vulnerabilities by crafting a specially designed MIFF format file and running the identify command with the verbose flag.
The heap-based buffer overflow vulnerability can result in arbitrary code execution or denial of service attacks. The memory information disclosure vulnerability allows an attacker to obtain sensitive information from the image's IPTC Profile.
Yes, upgrading the GraphicsMagick package to version 1.3.16-1.1+deb7u13 or later will address these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
