CVE-2014-1947: Buffer Overflow
A buffer overflow flaw affecting ImageMagick versions prior to 6.8.8-5 when handling PSD images was reported:
http://secunia.com/advisories/56844/
Diffing ImageMagick-6.8.7/coders/psd.c and ImageMagick-6.8.8/coders/psd.c, it looks like the flaw may be FormatLocaleString() writing the amount of 6 long integers (approximately 48 bytes) into a buffer (layername) that is only 4 bytes:
"" @@ -1224,7 +1224,7 @@ Allocate layered image. / layerinfo[i].image=CloneImage(image,layerinfo[i].page.width, - layerinfo[i].page.height == ~0U ? 1 : layerinfo[i].page.height, + layerinfo[i].page.height == ~0UL ? 1 : layerinfo[i].page.height, MagickFalse,&image->exception); if (layerinfo[i].image == (Image ) NULL) { @@ -2112,9 +2112,6 @@ StringInfo bimprofile; - unsigned char - layername[4]; - / Open image file. / @@ -2372,12 +2369,15 @@ property=(const char ) GetImageProperty(nextimage,"label"); if (property == (const char ) NULL) { + char + layername[MaxTextExtent]; + (void) WriteBlobMSBLong(image,16); (void) WriteBlobMSBLong(image,0); (void) WriteBlobMSBLong(image,0); - (void) FormatLocaleString((char ) layername,MaxTextExtent, - "L%06ld",(long) layercount++); - WritePascalString( image, (char)layername, 4 ); + (void) FormatLocaleString(layername,MaxTextExtent,"L%06ld",(long) + layercount++); + WritePascalString(image,layername,4); } else {
""
CVE request: http://www.openwall.com/lists/oss-security/2014/02/12/2
Other sources
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1947?
CVE-2014-1947 has been classified with a high severity level due to the potential for a remote exploit via crafted PSD images.
How do I fix CVE-2014-1947?
To fix CVE-2014-1947, update ImageMagick to version 6.8.8-5 or later, where the vulnerability has been addressed.
What software versions are affected by CVE-2014-1947?
CVE-2014-1947 affects ImageMagick versions prior to 6.8.8-5 and specific versions of SUSE Linux Enterprise Desktop and Server 11 SP3.
What type of vulnerability is CVE-2014-1947?
CVE-2014-1947 is a buffer overflow vulnerability that occurs when ImageMagick processes problematic PSD image files.
Can CVE-2014-1947 be exploited remotely?
Yes, CVE-2014-1947 can potentially be exploited remotely by an attacker sending a maliciously crafted PSD file to the affected system.