First Last Prev Next    This bug is not in your last search results.
Bug 1047898 - (CVE-2017-11141) VUL-2: CVE-2017-11141: ImageMagick: In ReadMATImage in coders\mat.c a memory leak allows for memory exhaustion via a crafted MAT file
(CVE-2017-11141)
VUL-2: CVE-2017-11141: ImageMagick: In ReadMATImage in coders\mat.c a memory ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/188225/
CVSSv3:SUSE:CVE-2017-11141:7.5:(AV:N/...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-07-10 08:42 UTC by Johannes Segitz
Modified: 2018-02-09 13:47 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Reproducer (288 bytes, text/plain)
2017-07-10 08:43 UTC, Johannes Segitz 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2017-07-10 08:42:21 UTC 
CVE-2017-11141

The ReadMATImage function in coders\mat.c in ImageMagick 7.0.5-6 has a memory
leak vulnerability that can cause memory exhaustion via a crafted MAT file,
related to incorrect ordering of a SetImageExtent call.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11141
https://github.com/ImageMagick/ImageMagick/issues/469
Comment 1 Johannes Segitz 2017-07-10 08:43:25 UTC 
Created attachment 731715 [details]
Reproducer

valgrind identify ImageMagick-7.0.5-6-memory-exhaustion.MAT

Only ImageMagick as far as I can tell.
Comment 2 Marcus Meissner 2017-09-27 13:09:46 UTC 
leaks small ImageInfo struct. can be defered.
Comment 4 Petr Gajdos 2018-01-08 08:45:20 UTC 
12/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
identify: memory allocation failed `ImageMagick-7.0.5-6-memory-exhaustion.MAT' @ error/mat.c/ReadMATImage/849.
==17994== 26,216 (16,792 direct, 9,424 indirect) bytes in 1 blocks are definitely lost in loss record 15 of 15
==17994==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==17994==    by 0x4F48E1F: AcquireImageInfo (image.c:334)
==17994==    by 0x4F4AB3D: CloneImageInfo (image.c:936)
==17994==    by 0x8418267: ???
==17994==    by 0x4EBFE1A: ReadImage (constitute.c:601)
==17994==    by 0x4FD1658: ReadStream (stream.c:974)
==17994==    by 0x4EBF960: PingImage (constitute.c:278)
==17994==    by 0x4EBFB9A: PingImages (constitute.c:373)
==17994==    by 0x535850B: IdentifyImageCommand (identify.c:322)
==17994==    by 0x5385C52: MagickCommandGenesis (mogrify.c:166)
==17994==    by 0x400891: IdentifyMain (identify.c:80)
==17994==    by 0x400891: main (identify.c:93)
==17994== 
$

AFTER

$ valgrind -q --leak-check=full identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
identify: improper image header `ImageMagick-7.0.5-6-memory-exhaustion.MAT' @ error/mat.c/ReadMATImage/948.
$
Comment 6 Petr Gajdos 2018-01-08 11:04:39 UTC 
11/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
identify: Memory allocation failed `No such file or directory'.
$

AFTER

$ valgrind -q --leak-check=full identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
identify: Improper image header `ImageMagick-7.0.5-6-memory-exhaustion.MAT'.
$

Not reproducible with the testcase. Because I am about to update mat.c (almost) to the state of 6.9.9-31, I believe the fix is in if applicable.
Comment 8 Petr Gajdos 2018-01-08 14:10:32 UTC 
HG/GraphicsMagick

$ valgrind -q --leak-check=full gm identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
gm identify: Improper image header (ImageMagick-7.0.5-6-memory-exhaustion.MAT).
gm identify: Request did not return an image.
$

42.x/GraphicsMagick

$ valgrind -q --leak-check=full gm identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
gm identify: Image pixel width limit exceeded (see -limit Width) (2147483652 > 268435455 "ImageMagick-7.0.5-6-memory-exhaustion.MAT").
gm identify: Request did not return an image.
$

11/GraphicsMagick:

$ valgrind -q --leak-check=full gm identify ImageMagick-7.0.5-6-memory-exhaustion.MAT
ImageMagick-7.0.5-6-memory-exhaustion.MAT MAT 8x2147483652+0+0 DirectClass 8-bit 288 0.000u 0:01
$

Does not reproduce.

*/GraphicsMagick: no quantum_info

Considering not affected.
Comment 9 Petr Gajdos 2018-01-08 15:02:24 UTC 
Will submit for 12/ImageMagick and 11/ImageMagick.
Comment 10 Petr Gajdos 2018-01-08 15:26:53 UTC 
I believe all fixed.
Comment 12 Swamp Workflow Management 2018-01-18 14:07:51 UTC 
SUSE-SU-2018:0130-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
Comment 13 Swamp Workflow Management 2018-01-18 14:12:01 UTC 
SUSE-SU-2018:0132-1: An update that fixes 31 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042948,1047044,1047898,1049373,1050120,1050606,1051412,1051446,1052252,1052468,1052550,1052710,1052720,1052731,1052732,1052771,1055065,1055323,1055434,1055855,1058082,1058640,1059751,1072902,1074122,1074123,1074425,1074610,1074969,1074973,1074975
CVE References: CVE-2017-1000445,CVE-2017-1000476,CVE-2017-10800,CVE-2017-11141,CVE-2017-11449,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-11751,CVE-2017-12430,CVE-2017-12434,CVE-2017-12564,CVE-2017-12642,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14249,CVE-2017-14326,CVE-2017-14533,CVE-2017-17680,CVE-2017-17881,CVE-2017-17882,CVE-2017-18022,CVE-2017-9409,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
Comment 14 Swamp Workflow Management 2018-01-20 17:12:08 UTC 
openSUSE-SU-2018:0155-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-49.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.21.1
Comment 15 Marcus Meissner 2018-02-09 13:47:24 UTC 
released
First Last Prev Next    This bug is not in your last search results.