CVE-2014-1947: Buffer Overflow
First published: Wed Feb 12 2014(Updated: )
A buffer overflow flaw affecting ImageMagick versions prior to 6.8.8-5 when handling PSD images was reported: <a href="http://secunia.com/advisories/56844/">http://secunia.com/advisories/56844/</a> Diffing ImageMagick-6.8.7/coders/psd.c and ImageMagick-6.8.8/coders/psd.c, it looks like the flaw may be FormatLocaleString() writing the amount of 6 long integers (approximately 48 bytes) into a buffer (layer_name) that is only 4 bytes: "" @@ -1224,7 +1224,7 @@ Allocate layered image. */ layer_info[i].image=CloneImage(image,layer_info[i].page.width, - layer_info[i].page.height == ~0U ? 1 : layer_info[i].page.height, + layer_info[i].page.height == ~0UL ? 1 : layer_info[i].page.height, MagickFalse,&image->exception); if (layer_info[i].image == (Image *) NULL) { @@ -2112,9 +2112,6 @@ StringInfo *bim_profile; - unsigned char - layer_name[4]; - /* Open image file. */ @@ -2372,12 +2369,15 @@ property=(const char *) GetImageProperty(next_image,"label"); if (property == (const char *) NULL) { + char + layer_name[MaxTextExtent]; + (void) WriteBlobMSBLong(image,16); (void) WriteBlobMSBLong(image,0); (void) WriteBlobMSBLong(image,0); - (void) FormatLocaleString((char *) layer_name,MaxTextExtent, - "L%06ld",(long) layer_count++); - WritePascalString( image, (char*)layer_name, 4 ); + (void) FormatLocaleString(layer_name,MaxTextExtent,"L%06ld",(long) + layer_count++); + WritePascalString(image,layer_name,4); } else { "" CVE request: <a href="http://www.openwall.com/lists/oss-security/2014/02/12/2">http://www.openwall.com/lists/oss-security/2014/02/12/2</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | <=6.5.4 | |
| SUSE Linux Enterprise Desktop | =11-sp3 | |
| SUSE Linux Enterprise Server | =11-sp3 | |
| Oracle Java SE | =11-sp3 | |
| SUSE Linux Enterprise Software Development Kit | =11-sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/56844/
- http://www.openwall.com/lists/oss-security/2014/02/12/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c0
- http://trac.imagemagick.org/changeset/13736
- http://trac.imagemagick.org/changeset/14801
- http://www.openwall.com/lists/oss-security/2014/02/12/13
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c2
- https://access.redhat.com/security/cve/CVE-2014-1958
- http://seclists.org/oss-sec/2014/q1/343
- http://www.openwall.com/lists/oss-security/2014/02/19/13
- https://access.redhat.com/security/cve/CVE-2014-1947
- https://access.redhat.com/security/cve/CVE-2014-2030
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1067278
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1067276
- http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=25128
- http://trac.imagemagick.org/changeset/1448
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1083082
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1083083
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1083084
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c11
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1083477
- http://pkgs.fedoraproject.org/cgit/GraphicsMagick.git/tree/GraphicsMagick-1.3.20-CVE-2014-1947.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c20
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c10
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1064098#c22
- http://sourceforge.net/p/graphicsmagick/bugs/234/
- https://bugzilla.redhat.com/show_bug.cgi?id=1064098
- http://www.openwall.com/lists/oss-security/2014/02/13/2
- http://www.openwall.com/lists/oss-security/2014/02/13/5
- https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/softwarecombine
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-1947
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/imagemagick
- canonical/imagemagick imagemagick
- version/imagemagick imagemagick/6.5.4
- vendor/suse
- canonical/suse linux enterprise desktop
- version/suse linux enterprise desktop/11-sp3
- canonical/suse linux enterprise server
- version/suse linux enterprise server/11-sp3
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/11-sp3