graphicsmagick: CVE-2017-12935: nvalid memory read in SetImageColorCallBack (image.c)

Debian Bug report logs - #872576
graphicsmagick: CVE-2017-12935: nvalid memory read in SetImageColorCallBack (image.c)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: graphicsmagick: CVE-2017-12935: nvalid memory read in SetImageColorCallBack (image.c)

Date: Fri, 18 Aug 2017 20:56:16 +0200

Source: graphicsmagick
Version: 1.3.26-5
Severity: important
Tags: patch security upstream

Hi,

the following vulnerability was published for graphicsmagick.

CVE-2017-12935[0]:
| The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26
| mishandles large MNG images, leading to an invalid memory read in the
| SetImageColorCallBack function in magick/image.c.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12935
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12935
[1] http://www.openwall.com/lists/oss-security/2017/08/18/4
[2] http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 872576-close@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi (GCS) <gcs@debian.org>

To: 872576-close@bugs.debian.org

Subject: Bug#872576: fixed in graphicsmagick 1.3.26-6

Date: Sun, 20 Aug 2017 15:06:15 +0000

Source: graphicsmagick
Source-Version: 1.3.26-6

We believe that the bug you reported is fixed in the latest version of
graphicsmagick, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 872576@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated graphicsmagick package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 20 Aug 2017 12:46:53 +0000
Source: graphicsmagick
Binary: graphicsmagick libgraphicsmagick-q16-3 libgraphicsmagick1-dev libgraphicsmagick++-q16-12 libgraphicsmagick++1-dev libgraphics-magick-perl graphicsmagick-imagemagick-compat graphicsmagick-libmagick-dev-compat graphicsmagick-dbg
Architecture: source amd64 all
Version: 1.3.26-6
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description:
 graphicsmagick - collection of image processing tools
 graphicsmagick-dbg - format-independent image processing - debugging symbols
 graphicsmagick-imagemagick-compat - image processing tools providing ImageMagick interface
 graphicsmagick-libmagick-dev-compat - image processing libraries providing ImageMagick interface
 libgraphics-magick-perl - format-independent image processing - perl interface
 libgraphicsmagick++-q16-12 - format-independent image processing - C++ shared library
 libgraphicsmagick++1-dev - format-independent image processing - C++ development files
 libgraphicsmagick-q16-3 - format-independent image processing - C shared library
 libgraphicsmagick1-dev - format-independent image processing - C development files
Closes: 872574 872575 872576
Changes:
 graphicsmagick (1.3.26-6) unstable; urgency=high
 .
   * Fix CVE-2017-12935: invalid memory read in the SetImageColorCallBack()
     with large MNG images (closes: #872576).
   * Fix CVE-2017-12936: use-after-free issue for data associated with
     exception reporting in the ReadWMFImage() function (closes: #872575).
   * Fix CVE-2017-12937: colormap heap-based buffer over-read in the
     ReadSUNImage() function (closes: #872574).
Checksums-Sha1:
 0bfd8ec7f3d46901e35bff06a4d74a63b41c7e87 2794 graphicsmagick_1.3.26-6.dsc
 478ec0ae1db625a8eb716ed25718608f8eec4635 147456 graphicsmagick_1.3.26-6.debian.tar.xz
 419426d23937f654ecbab86c025f35ca236d78cb 3173904 graphicsmagick-dbg_1.3.26-6_amd64.deb
 ea9d26361b220de460181a1ea8323cf034ec1224 23464 graphicsmagick-imagemagick-compat_1.3.26-6_all.deb
 80327b57d5172e666b4f95360745036cfc8b5700 26882 graphicsmagick-libmagick-dev-compat_1.3.26-6_all.deb
 ed3999c71498cea3dbfc8e684831a911270b0075 11467 graphicsmagick_1.3.26-6_amd64.buildinfo
 e9a34d2c9407898c2364732f8dd62d21fbda5ab8 864856 graphicsmagick_1.3.26-6_amd64.deb
 2f5ec4fbb496be4a9bd73bb0335ab8ca68089176 70032 libgraphics-magick-perl_1.3.26-6_amd64.deb
 95df521ffef05958fcf76e7174d8fb41a9d83969 117248 libgraphicsmagick++-q16-12_1.3.26-6_amd64.deb
 06ff10c4d9671f45e0a2edee3b6f7536f01d1248 302528 libgraphicsmagick++1-dev_1.3.26-6_amd64.deb
 f6f63609bfca162762e3c6a0f757c46d970ae3a8 1112298 libgraphicsmagick-q16-3_1.3.26-6_amd64.deb
 38614265c7becc17f3f8cc3096913e658584e65f 1334704 libgraphicsmagick1-dev_1.3.26-6_amd64.deb
Checksums-Sha256:
 766e15611f89600adf88b5f0ab32b712cd77909fd35f29c546438f4b1d22379c 2794 graphicsmagick_1.3.26-6.dsc
 23e7beaceaa8c379f49ac415c244968cca027aea70b810ea8165f954d55008f1 147456 graphicsmagick_1.3.26-6.debian.tar.xz
 a1a75a1ad109a40f64ec4cf9b34843f4daa2484606cf39bdc69eb8be9078a65f 3173904 graphicsmagick-dbg_1.3.26-6_amd64.deb
 e4e729e72130cf710feab59ba1a17feb1bf39211f53ecb6d7ce9cfe84e8b4b98 23464 graphicsmagick-imagemagick-compat_1.3.26-6_all.deb
 f640c7a560ad89d8c2db782daef1d30ec90004a5dda5c83eb1e3d34b61a5a3ce 26882 graphicsmagick-libmagick-dev-compat_1.3.26-6_all.deb
 21159ea9b3fab850f18f4909b9be6fa6ee817889b103b9aaa6ffacb109600735 11467 graphicsmagick_1.3.26-6_amd64.buildinfo
 12361951950a93f816104a937c412885145b60e04142ab5027ed20fc7857d10a 864856 graphicsmagick_1.3.26-6_amd64.deb
 d82fec46cd1cc5b419c598a4f0b4386e3c5b7d999d373ea4645af37da59abedf 70032 libgraphics-magick-perl_1.3.26-6_amd64.deb
 3364eddcb0af0d387b9b9bb0315ab5db76a18a671088c67618bf66cc93de7ea1 117248 libgraphicsmagick++-q16-12_1.3.26-6_amd64.deb
 b4d3199f2958b9b13301e69f3aa4346be86da36f0d9488f9861b60521b6a213b 302528 libgraphicsmagick++1-dev_1.3.26-6_amd64.deb
 6881e628fc7275d310f14523885911868e110cf3db6724aaa6495ef3a9f71067 1112298 libgraphicsmagick-q16-3_1.3.26-6_amd64.deb
 60fe7bbb01e4b35bb3a3d5efac7d639c5a790aa0fcd7fc74efcd4e8b94ef2a1f 1334704 libgraphicsmagick1-dev_1.3.26-6_amd64.deb
Files:
 052e7c0f3b68d8d3b5d939fdb29bbfeb 2794 graphics optional graphicsmagick_1.3.26-6.dsc
 41c1c64ee657fd209825376bc2df8b4d 147456 graphics optional graphicsmagick_1.3.26-6.debian.tar.xz
 37b96d3c9a88cc09c05107f3944e0140 3173904 debug extra graphicsmagick-dbg_1.3.26-6_amd64.deb
 bde46278152b56c08b604dd3e540c0a6 23464 graphics optional graphicsmagick-imagemagick-compat_1.3.26-6_all.deb
 869974294560558e974cbe415fdb07ed 26882 graphics optional graphicsmagick-libmagick-dev-compat_1.3.26-6_all.deb
 c6b340c159bc897b749933b7c4edafa2 11467 graphics optional graphicsmagick_1.3.26-6_amd64.buildinfo
 5cbe94380ec71e1a18eb65c564b8506b 864856 graphics optional graphicsmagick_1.3.26-6_amd64.deb
 ecfef0082a4975282848b77c3d210486 70032 perl optional libgraphics-magick-perl_1.3.26-6_amd64.deb
 8d81c306b7a3c2159bb100eb0303da82 117248 libs optional libgraphicsmagick++-q16-12_1.3.26-6_amd64.deb
 37351bd0171487a9ca2f7bc30f4f3839 302528 libdevel optional libgraphicsmagick++1-dev_1.3.26-6_amd64.deb
 f6f48f388a970a57769d065a6120e901 1112298 libs optional libgraphicsmagick-q16-3_1.3.26-6_amd64.deb
 1da6902a51c733b517681e8cb354218b 1334704 libdevel optional libgraphicsmagick1-dev_1.3.26-6_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAlmZnNgACgkQ3OMQ54ZM
yL9NLQ/8CNkqAGl8Q+287nxH9Ab3m/u1QoVpcVEceMYKRjBeAA6RR7BUt15sR6ws
UWkHvsOS60u2TA+jDfBKFXsP6gcaXE9eiYKk2zR6PvdH0v1UpZqLuMHCiu4ZNnh8
bPp7WgY8tJ0tdBEiYQld0OYkK1UXXEna2pMb0yAKigcizRzEzuW8rxjX8tPBJKBC
QI3/YAtB3TOF1GfXq/iwc2X3apjzOC21sRBaq3c8TJ4qpA7p9H6JJ5z0hQ1JnQOU
AexS2185MGICCftg5W3GE7it6xBbqQXB3KYUiPPT93KJZF4VcZwuV48PuM5GWsSP
f1f9vepqAVgQT1zvrRJHmJ2QtlMTCNoutpzRo2usW18e6EXNwdkKrGvwZv5v0Vi8
HMXsD3TyMGTiyqRDLRkfYzUooqz/VWYdqz7VwBUzWgckXJp+s7NuHB3YoPE7o+qR
zglq1u5xcg+0ZSp1g7NqVEwSjeRqQcxh73efTGCSL247/locVA6XlPbQNt1mfafQ
mIoRFdgsRJdd1pd387mGZ9oFWHJPjiAm2Z4QbzjYPMhl+4h4SmVQqyls/BtTjJ2W
ykjVi8Lt2mxKf/IPgcX7R9A1A7Uuw6OXcfUccMDH3992nprrUHyOx345QbBaqmD/
J6dVDggOxtzOvemn7Vl853zxLSv+wKmIcw3ey2yXmZ9vhAFzD54=
=rls7
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.