Bug 1016575 (CVE-2014-9915)

Summary:	VUL-0: CVE-2014-9915: imagemagick: Off-by-one count when parsing an 8BIM profile
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Mikhail Kasimov <mikhail.kasimov>
Component:	Incidents	Assignee:	Petr Gajdos <pgajdos>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	jsegitz, matthias.gerstner, peter.simons, pgajdos
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:	CVSSv2:SUSE:CVE-2014-9915:5.8:(AV:N/AC:M/Au:N/C:N/I:P/A:P) CVSSv2:NVD:CVE-2014-9915:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:RedHat:CVE-2014-9915:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Mikhail Kasimov 2016-12-20 19:51:25 UTC

Ref: http://seclists.org/oss-sec/2016/q4/713
==============================================

Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug-767240
Reference URL: https://security-tracker.debian.org/767240
Upstream commit: N/A
Upsteram issue: N/A
Upstream version fixed: 6.8.9-9

I could not find which exact commit patched this specific
vulnerability. All other issues reported here have patches
attached. Sorry for the inconvenience.
==============================================

Comment 1 Swamp Workflow Management 2016-12-20 23:01:03 UTC

bugbot adjusting priority

Comment 2 Matthias Gerstner 2016-12-21 13:13:33 UTC

The debian bug link above has a typo in it and is thus broken. This seems to
be the right one:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767240

Comment 3 Matthias Gerstner 2016-12-21 14:19:31 UTC

There's little to be found about this off-by-one count in 8BIM profile
reading.

The corresponding bugfix might have been this one, but I'm not completely sure:

http://git.imagemagick.org/repos/ImageMagick/commit/ff46116fa0fd9d36596db364702c71564f0b14a5

The bug is over two years old and was fixed in version 6.8.9-9 according to
the ChangeLog.

I still have to check our codestreams whether they're affected.

Comment 4 Matthias Gerstner 2016-12-21 14:37:55 UTC

As far as I see it the related function Sync8BimProfile() is not yet existing
in any of the SLE codestreams. In openSUSE the fixed version is already in
place.

Comment 5 Johannes Segitz 2016-12-28 11:19:51 UTC

*** Bug 1017306 has been marked as a duplicate of this bug. ***

Comment 6 Petr Gajdos 2017-01-23 13:43:52 UTC

(In reply to Matthias Gerstner from comment #4)
> As far as I see it the related function Sync8BimProfile() is not yet existing
> in any of the SLE codestreams. In openSUSE the fixed version is already in
> place.

I tend to agree.

And, in any case, 'there is a security bug somewhere in ImageMagick' is not a valid bug report.