Bug 1055430 – VUL-0: CVE-2017-13139: GraphicsMagick,ImageMagick: In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, theReadOneMNGImage function in coders/png.c has an out-of-bounds read withthe MNG CLIP chunk.

Bug 1055430 - (CVE-2017-13139) VUL-0: CVE-2017-13139: GraphicsMagick,ImageMagick: In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, theReadOneMNGImage function in coders/png.c has an out-of-bounds read withthe MNG CLIP chunk.

(CVE-2017-13139)
Summary:	VUL-0: CVE-2017-13139: GraphicsMagick,ImageMagick: In ImageMagick before 6.9....

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/190914/
Whiteboard:	CVSSv2:SUSE:CVE-2017-13139:7.8:(AV:N/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-08-24 07:15 UTC by Marcus Meissner
Modified:	2018-02-12 08:29 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2017-08-24 07:15:36 UTC

CVE-2017-13139

In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the
ReadOneMNGImage function in coders/png.c has an out-of-bounds read with
the MNG CLIP chunk.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870109

https://github.com/ImageMagick/ImageMagick/commit/22e0310345499ffe906c604428f2a3a668942b05 

Issue is likely a problem, will however likely just crash due to buffer overread.

No reproducer.

Comment 1 Marcus Meissner 2017-09-29 08:01:23 UTC

only some info leak potential.

Comment 2 Petr Gajdos 2017-10-23 11:26:47 UTC

GraphicsMagick commit:

http://hg.code.sf.net/p/graphicsmagick/code/diff/653a3d55168b/coders/png.c

And perhaps additional ImageMagick commit:

https://github.com/ImageMagick/ImageMagick/commit/78d4c5db50fbab0b4beb69c46c6167f2c6513dec

Comment 3 Petr Gajdos 2017-10-25 12:28:19 UTC

I believe all fixed.

Comment 4 Bernhard Wiedemann 2017-10-25 14:02:27 UTC

This is an autogenerated message for OBS integration:
This bug (1055430) was mentioned in
https://build.opensuse.org/request/show/536525 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/536526 42.2 / GraphicsMagick

Comment 6 Swamp Workflow Management 2017-10-27 22:18:07 UTC

openSUSE-SU-2017:2894-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1054596,1054598,1055042,1055050,1055430,1056431
CVE References: CVE-2017-12936,CVE-2017-12937,CVE-2017-13063,CVE-2017-13064,CVE-2017-13139,CVE-2017-13775
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-34.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.34.1

Comment 8 Swamp Workflow Management 2017-11-08 11:19:02 UTC

SUSE-SU-2017:2949-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873
CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1

Comment 9 Swamp Workflow Management 2017-11-12 17:12:46 UTC

openSUSE-SU-2017:2999-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873
CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-37.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.9.1

Comment 10 Swamp Workflow Management 2017-11-23 20:08:27 UTC

SUSE-SU-2017:3056-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1050135,1054596,1054598,1055042,1055050,1055430,1061873
CVE References: CVE-2017-11534,CVE-2017-12936,CVE-2017-12937,CVE-2017-13063,CVE-2017-13064,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.16.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.16.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.16.1

Comment 11 Swamp Workflow Management 2017-12-01 02:07:39 UTC

SUSE-SU-2017:3168-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1050135,1055219,1055430,1061873
CVE References: CVE-2017-11534,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1

Comment 12 Marcus Meissner 2018-02-12 08:29:15 UTC

released