Bug 1179218 (CVE-2020-25667)

Summary:	VUL-0: CVE-2020-25667: ImageMagick: heap-based buffer overflow in TIFFGetProfiles
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexandros Toptsoglou <atoptsoglou>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/272323/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexandros Toptsoglou 2020-11-25 16:08:34 UTC

CVE-2020-25667

ImageMagick 7.0.8-68 there is a heap-buffer-overflow at coders/tiff.c in TIFFGetProfiles.

Reference:
https://github.com/ImageMagick/ImageMagick/issues/1748

Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/986b5dff173413fa712db27eb677cdef15f0bab6

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1891613
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25667

Comment 1 Alexandros Toptsoglou 2020-11-25 16:12:05 UTC

Seems that the issue was introduced in 7.0.8-63[1] and 6.9.10-63 [2]. based on this none of our codestream is affected. Unfortunately the POC is not available to cross check. It would be beneficial if you Petr could also confirm.  


[1]https://github.com/ImageMagick/ImageMagick/commit/77ad22e52c79102b2258ec9fcd6d86901da280ca
[2] https://github.com/ImageMagick/ImageMagick6/commit/9246c8b7cbc8bef737bb0ad63c3e6f51cfaad6c0

Comment 2 Petr Gajdos 2020-12-09 14:35:23 UTC

Yes. If I get that correctly, profile is not guaranteed to be a null terminated string and strstr() goes beyond it.

Closing as fixed (in Factory).