Bug 1131317 (CVE-2019-10650)

Summary: VUL-1: CVE-2019-10650: GraphicsMagick,ImageMagick: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information dis
Product: [Novell Products] SUSE Security Incidents Reporter: Alexandros Toptsoglou <atoptsoglou>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P4 - Low CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/228519/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexandros Toptsoglou 2019-04-02 15:02:03 UTC 
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the
function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a
denial of service or information disclosure via a crafted image file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10650
http://www.securityfocus.com/bid/107646
https://github.com/ImageMagick/ImageMagick/issues/1532
Comment 1 Alexandros Toptsoglou 2019-04-02 15:36:42 UTC 
Fix available for version 7 is at [1] 
Backported fix for version 6 at [2] but pay attention because it may be problematic according to upstream. 

Reproducer at [3] 

Managed to reproduced in SLE15 by running : magick convert $POC /dev/null 

Managed to reproduced in SLE12/11 by running: convert $POC /dev/null

I did not test GraphicsMagick but I suspect that is also affected.

[1] https://github.com/ImageMagick/ImageMagick/commit/b0fe1aa7c2ed7becb892f121abdd68a6e6e0ce0b

[2] https://github.com/ImageMagick/ImageMagick6/commit/d8d844c6f23f4d90d8fe893fe9225dd78fc1e6ef#diff-7921baa12fcdef6fa0adfd27019adcd9

[3] https://drive.google.com/file/d/1VPmM34DHDhFYJCMKvRYIAH4iT14hVsOE/view
Comment 7 Petr Gajdos 2019-04-04 11:48:52 UTC 
BEFORE

15/ImageMagick

$ valgrind  -q convert heap_buffer_overflow_WriteTIFFImage.tiff /dev/null
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC64: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f37938 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E66: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC64: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f37940 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E66: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC77: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f3e478 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E90: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC77: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f3e480 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E90: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC99: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f3e578 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422EC0: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC99: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x920137C: WriteTIFFImage (tiff.c:4223)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455==  Address 0x8f3e580 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422EC0: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC64: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f37938 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E66: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC64: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f37940 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E66: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC77: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f3e478 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E90: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC77: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f3e480 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422E90: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CF0: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC99: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f3e578 is 0 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422EC0: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
==11455== Invalid read of size 8
==11455==    at 0x4C34CFE: memmove (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x942FC99: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9430EA7: TIFFRewriteDirectory (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9438666: TIFFFlush (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F514: TIFFCleanup (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x941F538: TIFFClose (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9202280: WriteTIFFImage (tiff.c:4231)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==  Address 0x8f3e580 is 8 bytes after a block of size 8 alloc'd
==11455==    at 0x4C2E01F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11455==    by 0x9420657: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9422EC0: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x9424043: TIFFSetField (in /usr/lib64/libtiff.so.5.3.0)
==11455==    by 0x92010AF: WriteTIFFImage (tiff.c:4171)
==11455==    by 0x4EB81D4: WriteImage (constitute.c:1188)
==11455==    by 0x4EB8863: WriteImages (constitute.c:1338)
==11455==    by 0x532911A: ConvertImageCommand (convert.c:3280)
==11455==    by 0x538DB54: MagickCommandGenesis (mogrify.c:183)
==11455==    by 0x10937F: MagickMain (magick.c:149)
==11455==    by 0x584CF49: (below main) (in /lib64/libc-2.26.so)
==11455== 
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/1000.
convert: Too large strip byte count 2130706437, strip 0. Limiting to 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/652.
convert: Read error at scanline 4294967295; got 1168 bytes, expected 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/652.
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/1000.
convert: Unknown field with tag 1024 (0x400) encountered. `TIFFReadDirectory' @ warning/tiff.c/TIFFWarnings/1000.
convert: TIFF directory is missing required "StripOffsets" field. `MissingRequired' @ error/tiff.c/TIFFErrors/652.
convert: IO error writing tag data. `TIFFWriteDirectoryTagData' @ error/tiff.c/TIFFErrors/652.
convert: Compression algorithm does not support random access. `/dev/null' @ error/tiff.c/TIFFErrors/652.
convert: IO error writing tag data. `TIFFWriteDirectoryTagData' @ error/tiff.c/TIFFErrors/652.
$

12/ImageMagick

$ valgrind  -q convert heap_buffer_overflow_WriteTIFFImage.tiff /dev/null
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E8896D: IsGrayPixel (pixel-private.h:35)
==11520==    by 0x4E8896D: IsGrayImage (attribute.c:738)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E889B3: IsGrayPixel (pixel-private.h:35)
==11520==    by 0x4E889B3: IsGrayImage (attribute.c:738)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E889CE: IsGrayPixel (pixel-private.h:35)
==11520==    by 0x4E889CE: IsGrayImage (attribute.c:738)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E889D3: IsGrayPixel (pixel-private.h:35)
==11520==    by 0x4E889D3: IsGrayImage (attribute.c:738)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E889D8: IsGrayImage (attribute.c:743)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E88A32: IsGrayImage (attribute.c:757)
==11520==    by 0x841E30A: WriteTIFFImage (tiff.c:3004)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x4E88B22: IsMonochromeImage (attribute.c:815)
==11520==    by 0x841FFF4: WriteTIFFImage (tiff.c:3011)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x5887FFB: _IO_file_overflow@@GLIBC_2.2.5 (in /lib64/libc-2.19.so)
==11520==    by 0x5884928: putc (in /lib64/libc-2.19.so)
==11520==    by 0x4E8F025: WriteBlob (blob.c:4108)
==11520==    by 0x866DACB: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x866ED70: TIFFFlushData1 (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x86428E7: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x841F0F3: WriteTIFFImage (tiff.c:3586)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Conditional jump or move depends on uninitialised value(s)
==11520==    at 0x866DACF: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x866ED70: TIFFFlushData1 (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x86428E7: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x841F0F3: WriteTIFFImage (tiff.c:3586)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==    by 0x531B933: ConvertImageCommand (convert.c:3154)
==11520==    by 0x5385C62: MagickCommandGenesis (mogrify.c:166)
==11520==    by 0x400836: ConvertMain (convert.c:81)
==11520==    by 0x400836: main (convert.c:92)
==11520== 
==11520== Syscall param write(buf) points to uninitialised byte(s)
==11520==    at 0x58ED4ED: ??? (in /lib64/libc-2.19.so)
==11520==    by 0x5886F02: _IO_file_write@@GLIBC_2.2.5 (in /lib64/libc-2.19.so)
==11520==    by 0x58865C2: new_do_write (in /lib64/libc-2.19.so)
==11520==    by 0x5887D64: _IO_do_write@@GLIBC_2.2.5 (in /lib64/libc-2.19.so)
==11520==    by 0x58889BE: _IO_switch_to_get_mode (in /lib64/libc-2.19.so)
==11520==    by 0x58866DD: _IO_file_seekoff@@GLIBC_2.2.5 (in /lib64/libc-2.19.so)
==11520==    by 0x58852C6: fseeko (in /lib64/libc-2.19.so)
==11520==    by 0x4E8D7D6: SeekBlob (blob.c:3604)
==11520==    by 0x8642B05: ??? (in /usr/lib64/libtiff.so.5.3.0)
==11520==    by 0x841F0F3: WriteTIFFImage (tiff.c:3586)
==11520==    by 0x4EC173B: WriteImage (constitute.c:1237)
==11520==    by 0x4EC1BEE: WriteImages (constitute.c:1394)
==11520==  Address 0x4029000 is not stack'd, malloc'd or (recently) free'd
==11520== 
TIFFWriteDirectoryTagData: IO error writing tag data.
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Too large strip byte count 2130706437, strip 0. Limiting to 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/584.
convert: Read error on strip 0; got 1168 bytes, expected 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/584.
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Unknown field with tag 1024 (0x400) encountered. `TIFFReadDirectory' @ warning/tiff.c/TIFFWarnings/883.
convert: TIFF directory is missing required "StripOffsets" field. `MissingRequired' @ error/tiff.c/TIFFErrors/584.
$
[no invalid reads that would ended up in libtiff]

11/ImageMagick
*/GraphicsMagick

No valgrind errors.


PATCH

see comment 1

If I understand correctly they are more strict which input they accept from now on.

GraphicsMagick: considering unaffected (no proof it is affected)


AFTER

15/ImageMagick

$ valgrind  -q convert heap_buffer_overflow_WriteTIFFImage.tiff /dev/null
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/1000.
convert: Too large strip byte count 2130706437, strip 0. Limiting to 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/652.
convert: Read error at scanline 4294967295; got 1168 bytes, expected 4116. `TIFFFillStrip' @ error/tiff.c/TIFFErrors/652.
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/1000.
convert: Unknown field with tag 1024 (0x400) encountered. `TIFFReadDirectory' @ warning/tiff.c/TIFFWarnings/1000.
convert: TIFF directory is missing required "StripOffsets" field. `MissingRequired' @ error/tiff.c/TIFFErrors/652.
$

12/ImageMagick

same output

11/ImageMagick

same output
Comment 8 Petr Gajdos 2019-04-04 11:53:21 UTC 
Package submitted for 15,12,11/ImageMagick.

I believe all fixed.
Comment 11 Swamp Workflow Management 2019-04-24 15:52:12 UTC 
SUSE-SU-2019:1019-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1122033,1130330,1131317,1132054,1132060
CVE References: CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-9956
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    ImageMagick-7.0.7.34-3.54.3
SUSE Linux Enterprise Module for Development Tools 15 (src):    ImageMagick-7.0.7.34-3.54.3
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    ImageMagick-7.0.7.34-3.54.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2019-04-25 16:17:34 UTC 
SUSE-SU-2019:1033-1: An update that solves 13 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106989,1106996,1107609,1120381,1122033,1124365,1124366,1124368,1128649,1130330,1131317,1132053,1132054,1132060
CVE References: CVE-2018-16412,CVE-2018-16413,CVE-2018-16644,CVE-2018-20467,CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-11009,CVE-2019-7175,CVE-2019-7395,CVE-2019-7397,CVE-2019-7398,CVE-2019-9956
Sources used:
SUSE OpenStack Cloud 7 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-SP4 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Server 12-LTSS (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.108.1
SUSE Enterprise Storage 4 (src):    ImageMagick-6.8.8.1-71.108.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2019-04-27 01:13:15 UTC 
SUSE-SU-2019:1033-2: An update that solves 13 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106989,1106996,1107609,1120381,1122033,1124365,1124366,1124368,1128649,1130330,1131317,1132053,1132054,1132060
CVE References: CVE-2018-16412,CVE-2018-16413,CVE-2018-16644,CVE-2018-20467,CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-11009,CVE-2019-7175,CVE-2019-7395,CVE-2019-7397,CVE-2019-7398,CVE-2019-9956
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    ImageMagick-6.8.8.1-71.108.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2019-05-03 19:15:04 UTC 
openSUSE-SU-2019:1320-1: An update that solves 13 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106989,1106996,1107609,1120381,1122033,1124365,1124366,1124368,1128649,1130330,1131317,1132053,1132054,1132060
CVE References: CVE-2018-16412,CVE-2018-16413,CVE-2018-16644,CVE-2018-20467,CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-11009,CVE-2019-7175,CVE-2019-7395,CVE-2019-7397,CVE-2019-7398,CVE-2019-9956
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-82.1
Comment 16 Swamp Workflow Management 2019-05-04 13:11:06 UTC 
openSUSE-SU-2019:1331-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1122033,1130330,1131317,1132054,1132060
CVE References: CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-9956
Sources used:
openSUSE Leap 15.0 (src):    ImageMagick-7.0.7.34-lp150.2.29.1
Comment 17 Swamp Workflow Management 2019-05-10 19:18:24 UTC 
SUSE-SU-2019:14043-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1130330,1131317,1132053,1132060,1133204,1133205,1133498,1133501
CVE References: CVE-2019-10650,CVE-2019-11007,CVE-2019-11009,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,CVE-2019-11506,CVE-2019-9956
Sources used:
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-78.97.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Marcus Meissner 2019-07-10 05:24:06 UTC 
released