First Last Prev Next    This bug is not in your last search results.
Bug 1052731 - (CVE-2017-12670) VUL-2: CVE-2017-12670: ImageMagick: Missing validation in coders/mat.c, leading to an assertion failure in DestroyImage
(CVE-2017-12670)
VUL-2: CVE-2017-12670: ImageMagick: Missing validation in coders/mat.c, leadi...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/189778/
CVSSv2:SUSE:CVE-2017-12670:5.0:(AV:N/...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-08-08 09:50 UTC by Johannes Segitz
Modified: 2018-01-31 20:27 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Reproducer (247 bytes, text/plain)
2017-08-08 09:50 UTC, Johannes Segitz 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2017-08-08 09:50:25 UTC 
Created attachment 735665 [details]
Reproducer

CVE-2017-12670

In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to
an assertion failure in the function DestroyImage in MagickCore/image.c, which
allows attackers to cause a denial of service.

identify assertion_failed_in_DestroyImage

SLE 12 only

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12670
https://github.com/ImageMagick/ImageMagick/issues/610
Comment 1 Marcus Meissner 2017-09-29 07:21:37 UTC 
controlled abort, deferable
Comment 3 Petr Gajdos 2018-01-08 08:45:07 UTC 
12/ImageMagick

BEFORE

$ identify assertion_failed_in_DestroyImage 
identify: magick/quantum.c:224: DestroyQuantumInfo: Assertion `quantum_info->signature == 0xabacadabUL' failed.
Aborted (core dumped)
$

AFTER

$ identify assertion_failed_in_DestroyImage 
identify: improper image header `assertion_failed_in_DestroyImage' @ error/mat.c/ReadMATImage/1424.
$
Comment 5 Petr Gajdos 2018-01-08 11:02:51 UTC 
ImageMagick/11

BEFORE

$ identify assertion_failed_in_DestroyImage 
identify: no decode delegate for this image format `assertion_failed_in_DestroyImage'.
$

AFTER

$ identify assertion_failed_in_DestroyImage 
identify: no decode delegate for this image format `assertion_failed_in_DestroyImage'.
$

Not reproducible with the testcase. Because I am about to update mat.c (almost) to the state of 6.9.9-31, I believe the fix is in if applicable.
Comment 7 Petr Gajdos 2018-01-08 12:48:57 UTC 
11/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: Image file or blob does not contain any image data.
gm identify: Request did not return an image.
$

42.x/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: Image file or blob does not contain any image data.
gm identify: Request did not return an image.
$

HG/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: No decode delegate for this image format (assertion_failed_in_DestroyImage).
$

Not reproducible.

11/GraphicsMagick: image2 variable is not there at all, not affected
42.x/GraphicsMagick: ThrowImg2MATReaderException(), considering affected
HG/GraphicsMagick: image2 is freed via ThrowImg2MATReaderException(), not affected
Comment 8 Petr Gajdos 2018-01-08 12:49:25 UTC 
Will submit for: 12/ImageMagick, 11/ImageMagick and 42.x/GraphicsMagick
Comment 9 Petr Gajdos 2018-01-08 15:26:50 UTC 
I believe all fixed.
Comment 10 Swamp Workflow Management 2018-01-08 15:50:30 UTC 
This is an autogenerated message for OBS integration:
This bug (1052731) was mentioned in
https://build.opensuse.org/request/show/562562 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/562563 42.2 / GraphicsMagick
Comment 11 Swamp Workflow Management 2018-01-09 13:10:30 UTC 
This is an autogenerated message for OBS integration:
This bug (1052731) was mentioned in
https://build.opensuse.org/request/show/562871 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/562872 42.2 / GraphicsMagick
Comment 13 Swamp Workflow Management 2018-01-15 14:08:58 UTC 
openSUSE-SU-2018:0087-1: An update that solves 13 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1047044,1049373,1050129,1051412,1052468,1052710,1052720,1052731,1055065,1055434,1058640,1067177,1074123,1074975
CVE References: CVE-2017-10800,CVE-2017-11449,CVE-2017-11532,CVE-2017-12564,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13648,CVE-2017-14326,CVE-2017-16547,CVE-2017-17881,CVE-2017-18022
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-57.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.60.1
Comment 14 Swamp Workflow Management 2018-01-18 14:09:04 UTC 
SUSE-SU-2018:0130-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
Comment 15 Swamp Workflow Management 2018-01-18 14:13:51 UTC 
SUSE-SU-2018:0132-1: An update that fixes 31 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042948,1047044,1047898,1049373,1050120,1050606,1051412,1051446,1052252,1052468,1052550,1052710,1052720,1052731,1052732,1052771,1055065,1055323,1055434,1055855,1058082,1058640,1059751,1072902,1074122,1074123,1074425,1074610,1074969,1074973,1074975
CVE References: CVE-2017-1000445,CVE-2017-1000476,CVE-2017-10800,CVE-2017-11141,CVE-2017-11449,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-11751,CVE-2017-12430,CVE-2017-12434,CVE-2017-12564,CVE-2017-12642,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14249,CVE-2017-14326,CVE-2017-14533,CVE-2017-17680,CVE-2017-17881,CVE-2017-17882,CVE-2017-18022,CVE-2017-9409,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
Comment 16 Swamp Workflow Management 2018-01-20 17:13:21 UTC 
openSUSE-SU-2018:0155-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-49.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.21.1
Comment 17 Andreas Stieger 2018-01-31 20:27:53 UTC 
releasing for Leap,done
First Last Prev Next    This bug is not in your last search results.