In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
The product reads data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
http://www.securityfocus.com/bid/102305 | vdb entry third party advisory |
https://usn.ubuntu.com/3681-1/ | third party advisory vendor advisory |
https://www.debian.org/security/2017/dsa-4074 | third party advisory vendor advisory |
https://lists.debian.org/debian-lts-announce/2018/01/msg00000.html | third party advisory mailing list |
https://www.debian.org/security/2018/dsa-4204 | third party advisory vendor advisory |
https://github.com/ImageMagick/ImageMagick/issues/906 | issue tracking vendor advisory |