ID CVE-2016-7448
Summary The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.
References
Vulnerable Configurations
  • GraphicsMagick 1.3.24
    cpe:2.3:a:graphicsmagick:graphicsmagick:1.3.24
  • openSUSE Leap 42.1
    cpe:2.3:o:opensuse:leap:42.1
  • OpenSUSE 13.2
    cpe:2.3:o:opensuse:opensuse:13.2
CVSS
Base: 7.8 (as of 08-02-2017 - 08:56)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1229.NASL
    description This update for GraphicsMagick fixes the following issues : - security update : - CVE-2016-8684 [boo#1005123] - CVE-2016-8682 [boo#1005125] - CVE-2016-8683 [boo#1005127] - security update : - CVE-2016-7529 [boo#1000399] - CVE-2016-7528 [boo#1000434] - CVE-2016-7515 [boo#1000689] - CVE-2016-7446 [boo#999673] - CVE-2016-7447 [boo#999673] - CVE-2016-7448 [boo#999673] - CVE-2016-7449 [boo#999673] - CVE-2016-7517 [boo#1000693] - CVE-2016-7519 [boo#1000695] - CVE-2016-7522 [boo#1000698] - CVE-2016-7524 [boo#1000700] - CVE-2016-7531 [boo#1000704] - CVE-2016-7533 [boo#1000707] - CVE-2016-7537 [boo#1000711] - CVE-2016-6823 [boo#1001066] - CVE-2016-7101 [boo#1001221] - do not divide by zero in WriteTIFFImage [boo#1002206] - fix buffer overflow [boo#1002209] - CVE-2016-7800 [boo#1002422] - CVE-2016-7996, CVE-2016-7997 [boo#1003629]
    last seen 2018-09-02
    modified 2017-02-09
    plugin id 94304
    published 2016-10-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94304
    title openSUSE Security Update : GraphicsMagick (openSUSE-2016-1229)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-683.NASL
    description Several vulnerabilities have been found in the graphicsmagick package that may lead to denial of service through failed assertions, CPU or memory usage. Some vulnerabilities may also lead to code execution but no exploit is currently known. CVE-2016-7448 Utah RLE: Reject truncated/absurd files which caused huge memory allocations and/or consumed huge CPU CVE-2016-7996 missing check that the provided colormap is not larger than 256 entries resulting in potential heap overflow CVE-2016-7997 denial of service via a crash due to an assertion CVE-2016-8682 stack-based buffer overflow in ReadSCTImage (sct.c) CVE-2016-8683 memory allocation failure in ReadPCXImage (pcx.c) CVE-2016-8684 memory allocation failure in MagickMalloc (memory.c) For Debian 7 'Wheezy', these problems have been fixed in version 1.3.16-1.1+deb7u5. We recommend that you upgrade your graphicsmagick packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-01-16
    modified 2018-07-09
    plugin id 94297
    published 2016-10-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94297
    title Debian DLA-683-1 : graphicsmagick security update
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2016-752.NASL
    description A possible heap overflow was discovered in the EscapeParenthesis() function (CVE-2016-7447). Various issues were found in the processing of SVG files in GraphicsMagick (CVE-2016-7446). The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software (CVE-2016-7449). The Utah RLE reader did not validate that header information was reasonable given the file size and so it could cause huge memory allocations and/or consume huge amounts of CPU, causing a denial of service (CVE-2016-7448)
    last seen 2019-01-16
    modified 2018-04-18
    plugin id 94018
    published 2016-10-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94018
    title Amazon Linux AMI : GraphicsMagick (ALAS-2016-752)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1401.NASL
    description Various security issues were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer overflows or overreads may lead to a denial of service or disclosure of in-memory information or other unspecified impact by processing a malformed image file. For Debian 8 'Jessie', these problems have been fixed in version 1.3.20-3+deb8u3. We recommend that you upgrade your graphicsmagick packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-01-16
    modified 2018-08-07
    plugin id 110727
    published 2018-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110727
    title Debian DLA-1401-1 : graphicsmagick security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1230.NASL
    description This update for GraphicsMagick fixes the following issues : - CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123) - CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127) - CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125) - CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629) - CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422) - CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711) - CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707) - CVE-2016-7531: Pbd file out of bound access (bsc#1000704) - CVE-2016-7529: out of bound in quantum handling (bsc#1000399) - CVE-2016-7528: Out of bound access in xcf file coder (bsc#1000434) - CVE-2016-7527: out of bound access in wpg file coder: (bsc#1000436) - CVE-2016-7526: out-of-bounds write in ./MagickCore/pixel-accessor.h (bsc#1000702) - CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700) - CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698) - CVE-2016-7519: out-of-bounds read in coders/rle.c (bsc#1000695) - CVE-2016-7517: out-of-bounds read in coders/pict.c (bsc#1000693) - CVE-2016-7516: Out of bounds problem in rle, pict, viff and sun files (bsc#1000692) - CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689) - CVE-2016-7446 CVE-2016-7447 CVE-2016-7448 CVE-2016-7449: various issues fixed in 1.3.25 (bsc#999673) - CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221) - CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066) - CVE-2016-5688: Various invalid memory reads in ImageMagick WPG (bsc#985442) - CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691) - CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690) - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209) - Divide by zero in WriteTIFFImage (bsc#1002206)
    last seen 2019-01-16
    modified 2017-02-09
    plugin id 94305
    published 2016-10-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94305
    title openSUSE Security Update : GraphicsMagick (openSUSE-2016-1230)
refmap via4
bid 93074
confirm https://bugzilla.redhat.com/show_bug.cgi?id=1374233
mlist
  • [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update
  • [oss-security] 20160918 Re: GraphicsMagick 1.3.25 fixes some security issues
suse
  • openSUSE-SU-2016:2641
  • openSUSE-SU-2016:2644
Last major update 08-02-2017 - 13:26
Published 06-02-2017 - 12:59
Last modified 30-10-2018 - 12:27
Back to Top