Bug 1076182 - (CVE-2017-18028) VUL-1: CVE-2017-18028: GraphicsMagick,ImageMagick: memory exhaustion in the function ReadTIFFImage in coders/tiff.c
(CVE-2017-18028)
VUL-1: CVE-2017-18028: GraphicsMagick,ImageMagick: memory exhaustion in the f...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: unspecified
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/198184/
CVSSv2:NVD:CVE-2017-18028:7.1:(AV:N/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-01-16 12:08 UTC by Marcus Meissner
Modified: 2019-05-01 14:02 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
memory_exhaustion_in_ReadTIFFImage_1934 (390 bytes, image/tiff)
2018-01-16 12:47 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-01-16 12:08:17 UTC
rh#1534736

In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the
function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a
denial of service via a crafted file.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1534736
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18028
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-18028.html
https://github.com/ImageMagick/ImageMagick/issues/736
Comment 1 Marcus Meissner 2018-01-16 12:47:52 UTC
Created attachment 756237 [details]
memory_exhaustion_in_ReadTIFFImage_1934

QA REPRODUCER:

convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null

gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
Comment 2 Marcus Meissner 2018-01-16 12:49:34 UTC
does not seen to trigger on SLE11 or Leap(SLE12) IM/GM.
Comment 3 Petr Gajdos 2018-01-30 11:53:18 UTC
BEFORE

12/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934' @ warning/tiff.c/TIFFWarnings/883.
convert: memory allocation failed `memory_exhaustion_in_ReadTIFFImage_1934' @ error/tiff.c/ReadTIFFImage/1660.
convert: no images defined `/dev/null' @ error/convert.c/ConvertImageCommand/3149.
$

11/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectory'.
convert: Integer overflow in TIFFVTileSize. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. `TIFFReadDirectory'.
convert: missing an image filename `/dev/null'.
$

11/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. (TIFFReadDirectory).
$

42.3/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: Memory allocation failed (memory_exhaustion_in_ReadTIFFImage_1934).
$

No issue observed.

PATCH

ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/740985d9bd3f1c50d622c3496bb2e75d44b65a91
Things like WidthResource or HeightResource are not available in older versions, though.

GraphicsMagick:
http://hg.code.sf.net/p/graphicsmagick/code/rev/752c0b41fa32

AFTER

12/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934' @ warning/tiff.c/TIFFWarnings/883.
convert: memory allocation failed `memory_exhaustion_in_ReadTIFFImage_1934' @ error/tiff.c/ReadTIFFImage/1645.
convert: no images defined `/dev/null' @ error/convert.c/ConvertImageCommand/3149.
$
[no change]

11/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectory'.
convert: Integer overflow in TIFFVTileSize. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. `TIFFReadDirectory'.
convert: missing an image filename `/dev/null'.
$
[no change]

42.3/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: Memory allocation failed (memory_exhaustion_in_ReadTIFFImage_1934).
$
[no change]

11/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. (TIFFReadDirectory).
$
[no change]
Comment 4 Petr Gajdos 2018-01-30 11:54:48 UTC
Will submit for 12/ImageMagick, 11/ImageMagick, 11/GraphicsMagick and 42.3/GraphicsMagick.
Comment 5 Petr Gajdos 2018-02-02 09:31:17 UTC
I believe all fixed.
Comment 6 Swamp Workflow Management 2018-02-09 16:30:26 UTC
This is an autogenerated message for OBS integration:
This bug (1076182) was mentioned in
https://build.opensuse.org/request/show/574758 42.3 / GraphicsMagick
Comment 7 Swamp Workflow Management 2018-02-12 09:30:29 UTC
This is an autogenerated message for OBS integration:
This bug (1076182) was mentioned in
https://build.opensuse.org/request/show/575511 42.3 / GraphicsMagick
Comment 8 Swamp Workflow Management 2018-02-16 11:16:25 UTC
openSUSE-SU-2018:0460-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047900,1049374,1051411,1058009,1073081,1074307,1076182
CVE References: CVE-2017-11140,CVE-2017-11450,CVE-2017-11722,CVE-2017-14224,CVE-2017-17502,CVE-2017-17912,CVE-2017-18028
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-68.1
Comment 9 Swamp Workflow Management 2018-02-20 14:11:02 UTC
SUSE-SU-2018:0486-1: An update that fixes 24 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1048110,1049374,1049375,1050048,1050617,1050669,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052761,1055069,1055229,1058009,1074119,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11448,CVE-2017-11450,CVE-2017-11537,CVE-2017-11637,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14224,CVE-2017-17885,CVE-2017-18028,CVE-2017-9407,CVE-2018-6405
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1
Comment 10 Swamp Workflow Management 2018-02-22 14:10:52 UTC
SUSE-SU-2018:0524-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1047900,1049374,1049375,1050617,1050669,1052248,1052251,1052254,1052472,1052688,1055069,1055229,1058009,1072934,1073081,1074307,1076182,1078433
CVE References: CVE-2017-11140,CVE-2017-11448,CVE-2017-11450,CVE-2017-11637,CVE-2017-11638,CVE-2017-11642,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12668,CVE-2017-13058,CVE-2017-13131,CVE-2017-14224,CVE-2017-17502,CVE-2017-17503,CVE-2017-17912,CVE-2017-18028,CVE-2017-9407,CVE-2018-6405
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.38.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.38.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.38.1
Comment 11 Swamp Workflow Management 2018-03-01 20:19:12 UTC
SUSE-SU-2018:0581-1: An update that fixes 35 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1042911,1048110,1048272,1049374,1049375,1050048,1050119,1050122,1050126,1050132,1050617,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052754,1052761,1055069,1055229,1056768,1057163,1058009,1072898,1074119,1074170,1075821,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11170,CVE-2017-11448,CVE-2017-11450,CVE-2017-11528,CVE-2017-11530,CVE-2017-11531,CVE-2017-11533,CVE-2017-11537,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12663,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14060,CVE-2017-14139,CVE-2017-14224,CVE-2017-17682,CVE-2017-17885,CVE-2017-17934,CVE-2017-18028,CVE-2017-9405,CVE-2017-9407,CVE-2018-5357,CVE-2018-6405
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
Comment 12 Andreas Stieger 2018-03-06 19:44:29 UTC
Releasing for Leap, showing as done otherwise
Comment 13 Swamp Workflow Management 2018-03-06 23:17:45 UTC
openSUSE-SU-2018:0621-1: An update that fixes 35 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1042911,1048110,1048272,1049374,1049375,1050048,1050119,1050122,1050126,1050132,1050617,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052754,1052761,1055069,1055229,1056768,1057163,1058009,1072898,1074119,1074170,1075821,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11170,CVE-2017-11448,CVE-2017-11450,CVE-2017-11528,CVE-2017-11530,CVE-2017-11531,CVE-2017-11533,CVE-2017-11537,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12663,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14060,CVE-2017-14139,CVE-2017-14224,CVE-2017-17682,CVE-2017-17885,CVE-2017-17934,CVE-2017-18028,CVE-2017-9405,CVE-2017-9407,CVE-2018-5357,CVE-2018-6405
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-55.1
Comment 14 Petr Gajdos 2018-04-24 15:10:34 UTC
Please note that GraphicsMagick will reference CVE-2017-18229 (bug 1085236) from now on. Therefore, this bug is ImageMagick only.
Comment 15 Marcus Meissner 2018-05-18 15:44:07 UTC
released