Bug 1055063 - (CVE-2017-13061) VUL-1: CVE-2017-13061: GraphicsMagick,ImageMagick: In ImageMagick 7.0.6-5, a length-validation vulnerability was found inthe function ReadPSDLayersInternal in coders/psd.c, which allowsattackers to cause a denial of service (ReadPSDImage
(CVE-2017-13061)
VUL-1: CVE-2017-13061: GraphicsMagick,ImageMagick: In ImageMagick 7.0.6-5, a ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/190881/
CVSSv2:SUSE:CVE-2017-13061:5.0:(AV:N/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-22 15:44 UTC by Marcus Meissner
Modified: 2018-02-12 08:26 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
memory_exhaustion_in_ReadPSDImage2157.psd (124 bytes, image/vnd.adobe.photoshop)
2017-08-22 15:44 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-08-22 15:44:10 UTC
CVE-2017-13061

In ImageMagick 7.0.6-5, a length-validation vulnerability was found in
the function ReadPSDLayersInternal in coders/psd.c, which allows
attackers to cause a denial of service (ReadPSDImage memory exhaustion)
via a crafted file.


https://github.com/ImageMagick/ImageMagick/issues/645
Comment 1 Marcus Meissner 2017-08-22 15:44:56 UTC
Created attachment 737822 [details]
memory_exhaustion_in_ReadPSDImage2157.psd

QA REPRODUCER:

identify memory_exhaustion_in_ReadPSDImage2157.psd
gm identify memory_exhaustion_in_ReadPSDImage2157.psd

will run out of memory.

(well, for some reason they do not :/ )
Comment 2 Marcus Meissner 2017-08-22 15:46:33 UTC
if we dont get memory exhaustion by default I would suggest WONTFIX/INVALID resolution.
Comment 3 Petr Gajdos 2017-12-12 12:10:26 UTC
42.2/GraphicsMagick and above does not have PSD decoder enabled.
Comment 4 Petr Gajdos 2017-12-12 15:30:37 UTC
I am not able to reproduce, too. gdb shows that the check is legitimate, the result AFTER is like:

$ identify -verbose memory_exhaustion_in_ReadPSDImage2157.psd            
identify: Insufficient image data in file `memory_exhaustion_in_ReadPSDImage2157.psd'.
$

Will submit for 12/ImageMagick, 11/ImageMagick and 11/GraphicsMagick.
Comment 5 Petr Gajdos 2017-12-14 10:54:08 UTC
I believe all fixed.
Comment 7 Swamp Workflow Management 2018-01-04 14:10:25 UTC
SUSE-SU-2018:0017-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1052460,1055053,1055063,1056550,1057723,1058422,1063049,1063050
CVE References: CVE-2017-12563,CVE-2017-12691,CVE-2017-13061,CVE-2017-13062,CVE-2017-14042,CVE-2017-14174,CVE-2017-14343,CVE-2017-15277,CVE-2017-15281
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.20.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.20.1
Comment 9 Swamp Workflow Management 2018-01-05 17:08:39 UTC
openSUSE-SU-2018:0025-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1052460,1055053,1055063,1056550,1057723,1058422,1063049,1063050
CVE References: CVE-2017-12563,CVE-2017-12691,CVE-2017-13061,CVE-2017-13062,CVE-2017-14042,CVE-2017-14174,CVE-2017-14343,CVE-2017-15277,CVE-2017-15281
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-43.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.15.1
Comment 10 Swamp Workflow Management 2018-01-09 11:14:15 UTC
SUSE-SU-2018:0043-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1052460,1055053,1055063,1056550,1057723,1058422,1063049,1063050
CVE References: CVE-2017-12563,CVE-2017-12691,CVE-2017-13061,CVE-2017-13062,CVE-2017-14042,CVE-2017-14174,CVE-2017-14343,CVE-2017-15277,CVE-2017-15281
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.17.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.17.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.17.1
Comment 11 Swamp Workflow Management 2018-01-24 20:13:28 UTC
SUSE-SU-2018:0197-1: An update that fixes 23 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047054,1048457,1049373,1050129,1051412,1051847,1052252,1052460,1052758,1052764,1052771,1055063,1056550,1057723,1058082,1058422,1060577,1061587,1063050,1067177,1074969,1074975
CVE References: CVE-2017-10799,CVE-2017-10800,CVE-2017-11188,CVE-2017-11449,CVE-2017-11532,CVE-2017-12140,CVE-2017-12430,CVE-2017-12563,CVE-2017-12642,CVE-2017-12644,CVE-2017-12662,CVE-2017-12691,CVE-2017-13061,CVE-2017-14042,CVE-2017-14174,CVE-2017-14249,CVE-2017-14343,CVE-2017-14733,CVE-2017-14994,CVE-2017-15277,CVE-2017-16547,CVE-2017-18022,CVE-2018-5247
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.28.2
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.28.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.28.2
Comment 12 Marcus Meissner 2018-02-12 08:26:43 UTC
released