Bug 1043353 – VUL-0: CVE-2017-9262: GraphicsMagick,ImageMagick: Memory leak in the ReadJNGImage function

Bug 1043353 - (CVE-2017-9262) VUL-0: CVE-2017-9262: GraphicsMagick,ImageMagick: Memory leak in the ReadJNGImage function

(CVE-2017-9262)
Summary:	VUL-0: CVE-2017-9262: GraphicsMagick,ImageMagick: Memory leak in the ReadJNGI...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/185996/
Whiteboard:	CVSSv3:SUSE:CVE-2017-9262:4.2:(AV:N/A...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-06-08 09:37 UTC by Alexander Bergmann
Modified:	2018-02-09 23:39 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2017-06-08 09:37:16 UTC

rh#1457320

In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows
attackers to cause a denial of service (memory leak) via a crafted file.

Upstream issue:
https://github.com/ImageMagick/ImageMagick/issues/475

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1457320
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9262
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9262.html
https://github.com/ImageMagick/ImageMagick/issues/475
http://www.securityfocus.com/bid/98735

Comment 1 Petr Gajdos 2018-01-10 08:50:41 UTC

https://github.com/ImageMagick/ImageMagick/commit/4649578df8dcbfb2b08d8623d52486dc124da3a8

Comment 2 Petr Gajdos 2018-01-14 20:29:03 UTC

12/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify memory-leak-in-ReadJNGImage-png5241.jng
identify: corrupt image `memory-leak-in-ReadJNGImage-png5241.jng' @ error/png.c/ReadOneJNGImage/4248.
==19677== 16,792 bytes in 1 blocks are definitely lost in loss record 22 of 23
==19677==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==19677==    by 0x841E5B1: ???
==19677==    by 0x841FDF5: ???
==19677==    by 0x4EBFE1A: ReadImage (constitute.c:601)
==19677==    by 0x4FD1658: ReadStream (stream.c:974)
==19677==    by 0x4EBF960: PingImage (constitute.c:278)
==19677==    by 0x4EBFB9A: PingImages (constitute.c:373)
==19677==    by 0x535850B: IdentifyImageCommand (identify.c:322)
==19677==    by 0x5385C52: MagickCommandGenesis (mogrify.c:166)
==19677==    by 0x400891: IdentifyMain (identify.c:80)
==19677==    by 0x400891: main (identify.c:93)
==19677== 
==19677== 23,240 (13,232 direct, 10,008 indirect) bytes in 1 blocks are definitely lost in loss record 23 of 23
==19677==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==19677==    by 0x4F4C9AC: AcquireImage (image.c:164)
==19677==    by 0x841E5D4: ???
==19677==    by 0x841FDF5: ???
==19677==    by 0x4EBFE1A: ReadImage (constitute.c:601)
==19677==    by 0x4FD1658: ReadStream (stream.c:974)
==19677==    by 0x4EBF960: PingImage (constitute.c:278)
==19677==    by 0x4EBFB9A: PingImages (constitute.c:373)
==19677==    by 0x535850B: IdentifyImageCommand (identify.c:322)
==19677==    by 0x5385C52: MagickCommandGenesis (mogrify.c:166)
==19677==    by 0x400891: IdentifyMain (identify.c:80)
==19677==    by 0x400891: main (identify.c:93)
==19677== 
$

AFTER

$ valgrind -q --leak-check=full identify memory-leak-in-ReadJNGImage-png5241.jng
identify: insufficient image data in file `memory-leak-in-ReadJNGImage-png5241.jng' @ error/png.c/ReadOneJNGImage/4319.
$

Comment 6 Petr Gajdos 2018-01-16 07:52:01 UTC

11/ImageMagick

BEFORE

$ valgrind -q --leak-check=full identify memory-leak-in-ReadJNGImage-png5241.jng
==10500== Invalid read of size 4
==10500==    at 0x4F08F71: IsImageObject (image.c:2386)
==10500==    by 0x9F10B8C: ReadJNGImage (png.c:3716)
==10500==    by 0x4E94D87: ReadImage (constitute.c:441)
==10500==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10500==    by 0x400DA7: main (identify.c:101)
==10500==  Address 0x9b05230 is 12,976 bytes inside a block of size 13,192 free'd
==10500==    at 0x4C243AF: free (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==10500==    by 0x4F1E6FE: RelinquishMagickMemory (memory.c:645)
==10500==    by 0x4F16F47: DestroyImageList (list.c:452)
==10500==    by 0x9F0F103: ReadOneJNGImage (png.c:3235)
==10500==    by 0x9F1094D: ReadJNGImage (png.c:3712)
==10500==    by 0x4E94D87: ReadImage (constitute.c:441)
==10500==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10500==    by 0x400DA7: main (identify.c:101)
==10500== 
==10500== Invalid read of size 8
==10500==    at 0x4F08F88: IsImageObject (image.c:2389)
==10500==    by 0x9F10B8C: ReadJNGImage (png.c:3716)
==10500==    by 0x4E94D87: ReadImage (constitute.c:441)
==10500==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10500==    by 0x400DA7: main (identify.c:101)
==10500==  Address 0x9b05298 is 13,080 bytes inside a block of size 13,192 free'd
==10500==    at 0x4C243AF: free (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==10500==    by 0x4F1E6FE: RelinquishMagickMemory (memory.c:645)
==10500==    by 0x4F16F47: DestroyImageList (list.c:452)
==10500==    by 0x9F0F103: ReadOneJNGImage (png.c:3235)
==10500==    by 0x9F1094D: ReadJNGImage (png.c:3712)
==10500==    by 0x4E94D87: ReadImage (constitute.c:441)
==10500==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10500==    by 0x400DA7: main (identify.c:101)
identify: Corrupt image `memory-leak-in-ReadJNGImage-png5241.jng'.
==10500== 
==10500== Syscall param unlink(pathname) points to unaddressable byte(s)
==10500==    at 0x8442807: unlink (in /lib64/libc-2.9.so)
==10500==    by 0x83DD0B8: remove (in /lib64/libc-2.9.so)
==10500==    by 0x4F58158: DestroyTemporaryResources (resource.c:292)
==10500==    by 0x4F67033: DestroySplayTree (splay-tree.c:723)
==10500==    by 0x4F58D80: DestroyMagickResources (resource.c:464)
==10500==    by 0x4F1DF84: MagickCoreTerminus (magick.c:1241)
==10500==    by 0x400E04: main (identify.c:117)
==10500==  Address 0x90641f0 is 0 bytes inside a block of size 21 free'd
==10500==    at 0x4C243AF: free (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==10500==    by 0x4F1E6FE: RelinquishMagickMemory (memory.c:645)
==10500==    by 0x4F67001: DestroySplayTree (splay-tree.c:719)
==10500==    by 0x4F58D80: DestroyMagickResources (resource.c:464)
==10500==    by 0x4F1DF84: MagickCoreTerminus (magick.c:1241)
==10500==    by 0x400E04: main (identify.c:117)
==10500== 
==10500== 
==10500== 41,520 (13,192 direct, 28,328 indirect) bytes in 1 blocks are definitely lost in loss record 6 of 7
==10500==    at 0x4C256AE: malloc (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==10500==    by 0x4F0B420: AcquireImage (image.c:152)
==10500==    by 0x9F0F2BB: ???
==10500==    by 0x9F1094D: ???
==10500==    by 0x4E94D87: ReadImage (constitute.c:441)
==10500==    by 0x52D0C14: IdentifyImageCommand (identify.c:297)
==10500==    by 0x400DA7: main (identify.c:101)
$

AFTER

$ valgrind -q --leak-check=full identify memory-leak-in-ReadJNGImage-png5241.jng
identify: Insufficient image data in file `memory-leak-in-ReadJNGImage-png5241.jng'.
$

Comment 7 Petr Gajdos 2018-01-16 10:59:56 UTC

42.x/GraphicsMagick

BEFORE

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadJNGImage-png5241.jng
gm identify: Corrupt image (memory-leak-in-ReadJNGImage-png5241.jng).
gm identify: Request did not return an image.
==1367== 67,781 bytes in 1 blocks are definitely lost in loss record 12 of 12
==1367==    at 0x4C29110: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==1367==    by 0x79D9CBE: ???
==1367==    by 0x79DBB2D: ???
==1367==    by 0x4EBEB77: ReadImage (constitute.c:1607)
==1367==    by 0x4EBF991: PingImage (constitute.c:1370)
==1367==    by 0x4E8DF3C: IdentifyImageCommand (command.c:8375)
==1367==    by 0x4E8F884: MagickCommand (command.c:8868)
==1367==    by 0x4E9099D: GMCommandSingle (command.c:17376)
==1367==    by 0x4EB1D2D: GMCommand (command.c:17429)
==1367==    by 0x54406E4: (below main) (in /lib64/libc-2.22.so)
==1367== 
$

AFTER

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadJNGImage-png5241.jng
gm identify: Insufficient image data in file (memory-leak-in-ReadJNGImage-png5241.jng).
gm identify: Request did not return an image.
$

Comment 10 Swamp Workflow Management 2018-01-16 14:30:05 UTC

This is an autogenerated message for OBS integration:
This bug (1043353) was mentioned in
https://build.opensuse.org/request/show/566430 42.3 / GraphicsMagick

Comment 11 Swamp Workflow Management 2018-01-16 15:10:07 UTC

This is an autogenerated message for OBS integration:
This bug (1043353) was mentioned in
https://build.opensuse.org/request/show/566436 42.2 / GraphicsMagick

Comment 12 Petr Gajdos 2018-01-19 12:05:39 UTC

11/GraphicsMagick

BEFORE

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadJNGImage-png5241.jng
gm identify: Corrupt image (memory-leak-in-ReadJNGImage-png5241.jng).
==22572== 
==22572== 11,256 (6,840 direct, 4,416 indirect) bytes in 1 blocks are definitely lost in loss record 5 of 5
==22572==    at 0x4C256AE: malloc (in /usr/lib64/valgrind/amd64-linux/vgpreload_memcheck.so)
==22572==    by 0x4EEBEA6: AllocateImage (image.c:258)
==22572==    by 0x802C719: ???
==22572==    by 0x802DEB3: ???
==22572==    by 0x4EA01CC: ReadImage (constitute.c:6000)
==22572==    by 0x4EFC39D: ReadStream (pixel_cache.c:3653)
==22572==    by 0x4EA0FA8: PingImage (constitute.c:5770)
==22572==    by 0x4E86A87: IdentifyImageCommand (command.c:7204)
==22572==    by 0x4E73683: MagickCommand (command.c:7657)
==22572==    by 0x4E737FE: GMCommand (command.c:15277)
==22572==    by 0x76E2585: (below main) (in /lib64/libc-2.9.so)
$

AFTER

$ valgrind -q --leak-check=full gm identify memory-leak-in-ReadJNGImage-png5241.jng
gm identify: Insufficient image data in file (memory-leak-in-ReadJNGImage-png5241.jng).
$

Comment 13 Petr Gajdos 2018-01-22 11:35:02 UTC

Submitted for: 12/ImageMagick, 11/ImageMagick, 11/Graphicsmagick and 42.x/GraphicsMagick

Comment 15 Petr Gajdos 2018-01-22 12:24:48 UTC

I believe all fixed.

Comment 16 Swamp Workflow Management 2018-01-25 20:08:18 UTC

openSUSE-SU-2018:0218-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1051442,1052708,1052717,1052777,1054600,1055374,1055455,1057000,1062752
CVE References: CVE-2017-11750,CVE-2017-12641,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-15218,CVE-2017-9261,CVE-2017-9262
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-60.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.63.1

Comment 19 Swamp Workflow Management 2018-02-02 14:08:32 UTC

SUSE-SU-2018:0349-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1

Comment 20 Swamp Workflow Management 2018-02-02 14:14:20 UTC

SUSE-SU-2018:0350-1: An update that solves 30 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2

Comment 21 Swamp Workflow Management 2018-02-08 11:12:24 UTC

openSUSE-SU-2018:0396-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-52.1

Comment 22 Marcus Meissner 2018-02-09 13:40:23 UTC

released

Comment 23 Swamp Workflow Management 2018-02-09 20:08:54 UTC

SUSE-SU-2018:0413-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1047910,1050037,1050072,1050100,1051442,1052470,1052708,1052717,1052768,1052777,1052781,1054600,1055038,1055374,1055455,1055456,1057000,1060162,1062752,1067198,1073690,1074023,1074120,1074125,1074175,1075939
CVE References: CVE-2014-9811,CVE-2017-10995,CVE-2017-11102,CVE-2017-11505,CVE-2017-11526,CVE-2017-11539,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13065,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14174,CVE-2017-14649,CVE-2017-15218,CVE-2017-15238,CVE-2017-16669,CVE-2017-17501,CVE-2017-17504,CVE-2017-17782,CVE-2017-17879,CVE-2017-17884,CVE-2017-17915,CVE-2017-8352,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1