CVE-2016-7446: Buffer Overflow
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.
Other sources
Various issues were fixed in GraphicsMagick 1.3.25:
1. A last instance of CVE-2016-2317 [tracked as bug 1306148] (heap buffer overflow) in the MVG rendering code (also impacts SVG). This problem was originally reported by Gustavo Grieco.
2. A possible heap overflow of the EscapeParenthesis() function. While I was not able to reproduce it for myself, the implementation is replaced with a different algorithm. This problem was reported by Gustavo Grieco.
3. The Utah RLE reader did not validate that header information was reasonable given the file size and so it could cause huge memory allocations and/or consume huge amounts of CPU. This problem was reported by Agostino Sarubbo.
4. The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software.
References:
http://www.openwall.com/lists/oss-security/2016/09/07/4
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7446?
CVE-2016-7446 is considered a moderate severity vulnerability due to its potential for buffer overflow exploitation.
How do I fix CVE-2016-7446?
To fix CVE-2016-7446, upgrade GraphicsMagick to version 1.3.25 or later.
Which versions of GraphicsMagick are affected by CVE-2016-7446?
CVE-2016-7446 affects GraphicsMagick version 1.3.24 and prior.
Can CVE-2016-7446 be exploited remotely?
Yes, CVE-2016-7446 allows remote attackers to exploit the vulnerability through specific vectors.
What types of systems are affected by CVE-2016-7446?
CVE-2016-7446 impacts systems running GraphicsMagick 1.3.24 on various Linux distributions, including Debian and openSUSE.