Bug 1043354 – VUL-1: CVE-2017-9261: GraphicsMagick, ImageMagick: Memory leak in the ReadMNGImage function

Bug 1043354 - (CVE-2017-9261) VUL-1: CVE-2017-9261: GraphicsMagick, ImageMagick: Memory leak in the ReadMNGImage function

(CVE-2017-9261)
Summary:	VUL-1: CVE-2017-9261: GraphicsMagick, ImageMagick: Memory leak in the ReadMNG...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/185995/
Whiteboard:	CVSSv2:NVD:CVE-2017-9261:4.3:(AV:N/AC...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-06-08 09:38 UTC by Alexander Bergmann
Modified:	2018-02-09 23:39 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2017-06-08 09:38:20 UTC

rh#1457318

In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows
attackers to cause a denial of service (memory leak) via a crafted file.

Upstream issue:
https://github.com/ImageMagick/ImageMagick/issues/476

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1457318
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9261
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9261.html
https://github.com/ImageMagick/ImageMagick/issues/476
http://www.securityfocus.com/bid/98730

Comment 1 Petr Gajdos 2018-01-10 08:52:54 UTC

https://github.com/ImageMagick/ImageMagick/commit/01d522e990aa57cbe67d222dd5e8f7196cc6d199

Comment 2 Petr Gajdos 2018-01-14 20:39:24 UTC

12/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify memory-leak-in-ReadMNGImage-png7706.mng
identify: width or height exceeds limit `memory-leak-in-ReadMNGImage-png7706.mng' @ error/png.c/ReadOneMNGImage/5228.
==20149== 28 bytes in 1 blocks are definitely lost in loss record 6 of 10
==20149==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20149==    by 0x8431537: ???
==20149==    by 0x8435B04: ???
==20149==    by 0x4EBFE1A: ReadImage (constitute.c:601)
==20149==    by 0x4FD1658: ReadStream (stream.c:974)
==20149==    by 0x4EBF960: PingImage (constitute.c:278)
==20149==    by 0x4EBFB9A: PingImages (constitute.c:373)
==20149==    by 0x535850B: IdentifyImageCommand (identify.c:322)
==20149==    by 0x5385C52: MagickCommandGenesis (mogrify.c:166)
==20149==    by 0x400891: IdentifyMain (identify.c:80)
==20149==    by 0x400891: main (identify.c:93)
==20149== 
$

AFTER

$ valgrind -q --leak-check=full identify memory-leak-in-ReadMNGImage-png7706.mng
identify: width or height exceeds limit `memory-leak-in-ReadMNGImage-png7706.mng' @ error/png.c/ReadOneMNGImage/5369.
$

Comment 6 Petr Gajdos 2018-01-16 07:18:46 UTC

11/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify memory-leak-in-ReadMNGImage-png7706.mng
identify: Width or height exceeds limit `memory-leak-in-ReadMNGImage-png7706.mng'.
==10534== 
==10534== 28 bytes in 1 blocks are definitely lost in loss record 1 of 2
==10534==    at 0x4C256AE: malloc (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==10534==    by 0x9F1A19A: ???
==10534==    by 0x4E94D87: ReadImage (constitute.c:441)
==10534==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10534==    by 0x400DA7: main (identify.c:101)
$

AFTER

$ valgrind -q --leak-check=full identify memory-leak-in-ReadMNGImage-png7706.mng
identify: Width or height exceeds limit `memory-leak-in-ReadMNGImage-png7706.mng'.
$

Comment 7 Petr Gajdos 2018-01-16 11:02:01 UTC

42.x/GraphicsMagick

BEFORE

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadMNGImage-png7706.mng
gm identify: Corrupt image (memory-leak-in-ReadMNGImage-png7706.mng).
gm identify: Request did not return an image.
==1443== 262,157 bytes in 1 blocks are definitely lost in loss record 12 of 12
==1443==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==1443==    by 0x79DC805: ???
==1443==    by 0x4EBEB77: ReadImage (constitute.c:1607)
==1443==    by 0x4EBF991: PingImage (constitute.c:1370)
==1443==    by 0x4E8DF3C: IdentifyImageCommand (command.c:8375)
==1443==    by 0x4E8F884: MagickCommand (command.c:8868)
==1443==    by 0x4E9099D: GMCommandSingle (command.c:17376)
==1443==    by 0x4EB1D2D: GMCommand (command.c:17429)
==1443==    by 0x54406E4: (below main) (in /lib64/libc-2.22.so)
==1443== 
$

AFTER

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadMNGImage-png7706.mng
gm identify: Improper image header (memory-leak-in-ReadMNGImage-png7706.mng).
gm identify: Request did not return an image.
$

Comment 10 Swamp Workflow Management 2018-01-16 14:30:11 UTC

This is an autogenerated message for OBS integration:
This bug (1043354) was mentioned in
https://build.opensuse.org/request/show/566430 42.3 / GraphicsMagick

Comment 11 Swamp Workflow Management 2018-01-16 15:10:12 UTC

This is an autogenerated message for OBS integration:
This bug (1043354) was mentioned in
https://build.opensuse.org/request/show/566436 42.2 / GraphicsMagick

Comment 12 Petr Gajdos 2018-01-19 19:33:40 UTC

11/GraphicsMagick

BEFORE

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadMNGImage-png7706.mng
gm identify: Improper image header (memory-leak-in-ReadMNGImage-png7706.mng).
==20788== 
==20788== 20,512 bytes in 1 blocks are definitely lost in loss record 2 of 2
==20788==    at 0x4C256AE: malloc (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==20788==    by 0x8037EFF: ???
==20788==    by 0x4EA01CC: ReadImage (constitute.c:6000)
==20788==    by 0x4EFC39D: ReadStream (pixel_cache.c:3653)
==20788==    by 0x4EA0FA8: PingImage (constitute.c:5770)
==20788==    by 0x4E86A87: IdentifyImageCommand (command.c:7204)
==20788==    by 0x4E73683: MagickCommand (command.c:7657)
==20788==    by 0x4E737FE: GMCommand (command.c:15277)
==20788==    by 0x76E2585: (below main) (in /lib64/libc-2.9.so)
$

AFTER

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadMNGImage-png7706.mng
gm identify: Improper image header (memory-leak-in-ReadMNGImage-png7706.mng).
$

Comment 13 Petr Gajdos 2018-01-22 11:35:43 UTC

Submitted for: 12/ImageMagick, 11/ImageMagick, 11/Graphicsmagick and 42.x/GraphicsMagick

Comment 15 Petr Gajdos 2018-01-22 12:24:50 UTC

I believe all fixed.

Comment 16 Swamp Workflow Management 2018-01-25 20:08:27 UTC

openSUSE-SU-2018:0218-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1051442,1052708,1052717,1052777,1054600,1055374,1055455,1057000,1062752
CVE References: CVE-2017-11750,CVE-2017-12641,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-15218,CVE-2017-9261,CVE-2017-9262
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-60.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.63.1

Comment 19 Swamp Workflow Management 2018-02-02 14:08:43 UTC

SUSE-SU-2018:0349-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1

Comment 20 Swamp Workflow Management 2018-02-02 14:14:29 UTC

SUSE-SU-2018:0350-1: An update that solves 30 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2

Comment 21 Swamp Workflow Management 2018-02-08 11:12:34 UTC

openSUSE-SU-2018:0396-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-52.1

Comment 22 Marcus Meissner 2018-02-09 13:40:53 UTC

released

Comment 23 Swamp Workflow Management 2018-02-09 20:09:03 UTC

SUSE-SU-2018:0413-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1047910,1050037,1050072,1050100,1051442,1052470,1052708,1052717,1052768,1052777,1052781,1054600,1055038,1055374,1055455,1055456,1057000,1060162,1062752,1067198,1073690,1074023,1074120,1074125,1074175,1075939
CVE References: CVE-2014-9811,CVE-2017-10995,CVE-2017-11102,CVE-2017-11505,CVE-2017-11526,CVE-2017-11539,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13065,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14174,CVE-2017-14649,CVE-2017-15218,CVE-2017-15238,CVE-2017-16669,CVE-2017-17501,CVE-2017-17504,CVE-2017-17782,CVE-2017-17879,CVE-2017-17884,CVE-2017-17915,CVE-2017-8352,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1