REDHAT-BUG-844105
First published: Sat Jul 28 2012(Updated: )
Tom Lane (tgl) found an issue in ImageMagick that is also present in GraphicsMagick. Basically <a href="https://access.redhat.com/security/cve/CVE-2011-3026">CVE-2011-3026</a> deals with libpng memory allocation, limitations have been added so that a bad PNG can't cause the system to allocate a lot of memory causing a denial of service. However on further investigation of ImageMagick Tom Lane found that PNG malloc function (Magick_png_malloc) in turn calls AcquireMagickMemory with an improper size argument: #ifdef PNG_USER_MEM_SUPPORTED static png_voidp Magick_png_malloc(png_structp png_ptr,png_uint_32 size) { (void) png_ptr; return((png_voidp) AcquireMagickMemory((size_t) size)); } Similar code is present in GraphicsMagick: #ifdef PNG_USER_MEM_SUPPORTED static png_voidp png_IM_malloc(png_structp png_ptr,png_uint_32 size) { (void) png_ptr; return MagickAllocateMemory(png_voidp,(size_t) size); } This is incorrect, the size argument should be declared png_alloc_size_t according to 1.5, or png_size_t according to 1.2. "As this function stands, it invisibly does the wrong thing for any request over 4GB. On big-endian architectures it very possibly will do the wrong thing even for requests less than that. So the reason why the hard-wired 4GB limit prevents a core dump is that it masks the ABI mismatch here." So basically we have memory allocations problems that can probably lead to a denial of service.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | ||
| GraphicsMagick |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2011-3026
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=844106
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=844107
- http://graphicsmagick.hg.sourceforge.net/hgweb/graphicsmagick/graphicsmagick/rev/d6e469d02cd2
- https://access.redhat.com/security/cve/CVE-2012-3437
- https://access.redhat.com/security/cve/CVE-2012-3438
- https://bugzilla.redhat.com/show_bug.cgi?id=844105
Frequently Asked Questions
What is the severity of REDHAT-BUG-844105?
The severity of REDHAT-BUG-844105 is categorized as high due to potential memory allocation issues in ImageMagick and GraphicsMagick.
How do I fix REDHAT-BUG-844105?
To fix REDHAT-BUG-844105, update to the patched versions of ImageMagick or GraphicsMagick as provided by your system's package manager.
What systems are affected by REDHAT-BUG-844105?
REDHAT-BUG-844105 affects the ImageMagick and GraphicsMagick software on various operating systems.
What is the root cause of REDHAT-BUG-844105?
The root cause of REDHAT-BUG-844105 is related to libpng memory allocation issues that can lead to system instability.
Are there any workarounds for REDHAT-BUG-844105?
A temporary workaround for REDHAT-BUG-844105 is to avoid using vulnerable features of ImageMagick or GraphicsMagick until an update is applied.
- collector/redhat-bugzilla
- alias/CVE-2012-3438
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/imagemagick
- canonical/imagemagick imagemagick
- vendor/graphicsmagick
- canonical/graphicsmagick