GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/101658 | vdb entry third party advisory |
| https://www.exploit-db.com/exploits/43111/ | exploit vdb entry third party advisory |
| http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185 | |
| https://www.debian.org/security/2018/dsa-4321 | third party advisory vendor advisory |
| https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html | third party advisory mailing list |
| https://blogs.securiteam.com/index.php/archives/3494 | third party advisory exploit |
| https://lists.debian.org/debian-lts-announce/2017/11/msg00002.html | third party advisory mailing list |
| ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt | release notes vendor advisory |
| https://usn.ubuntu.com/4232-1/ | vendor advisory |