Bugzilla – Bug 1159861
VUL-0: CVE-2019-19948: ImageMagick: heap-based buffer overflow in the function WriteSGIImage
Last modified: 2020-05-12 18:45:55 UTC
CVE-2019-19948 In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19948 https://github.com/ImageMagick/ImageMagick/issues/1562 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19948
Tracked all codestreams as affected since the patch can be applied to all. However, I could not reproduce with valgrind in Leap 15.1. According to [1] to reproduce run: convert $POC test.sgi
Created attachment 826762 [details] POC
[1] https://github.com/ImageMagick/ImageMagick/issues/1562
BEFORE I am not able to reproduce with 15,12/ImageMagick built with asan either: $ convert heap-buffer-overflow_WriteSGIImage.bmp test.sgi convert: length and filesize do not match `heap-buffer-overflow_WriteSGIImage.bmp' @ warning/bmp.c/ReadBMPImage/830. convert: insufficient image data in file `heap-buffer-overflow_WriteSGIImage.bmp' @ error/bmp.c/ReadBMPImage/958. convert: no images defined `test.sgi' @ error/convert.c/ConvertImageCommand/3275. $ Nor with 11/ImageMagick run with valgrind. No luck with 15.1,15.2/GraphicsMagick as well: $ gm convert heap-buffer-overflow_WriteSGIImage.bmp test.sgi gm convert: Compression not valid (heap-buffer-overflow_WriteSGIImage.bmp). $ PATCH https://github.com/ImageMagick/ImageMagick/commit/6ae32a9038e360b3491969d5d03d490884f02b4c https://github.com/ImageMagick/ImageMagick6/commit/9e7db22f8c374301db3f968757f0d08070fd4e54 GraphicsMagick: I think it is not affected as do-while block is run just once AFTER $ convert heap-buffer-overflow_WriteSGIImage.bmp ./test.sgi convert: length and filesize do not match `heap-buffer-overflow_WriteSGIImage.bmp' @ warning/bmp.c/ReadBMPImage/830. convert: insufficient image data in file `heap-buffer-overflow_WriteSGIImage.bmp' @ error/bmp.c/ReadBMPImage/958. convert: no images defined `./test.sgi' @ error/convert.c/ConvertImageCommand/3275. $ [no change]
Will submit for 15,12,11/ImageMagick.
Packages submitted. I believe all fixed.
SUSE-SU-2020:0275-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1159861,1160369,1161194 CVE References: CVE-2019-19948,CVE-2019-19949 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): ImageMagick-7.0.7.34-3.79.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): ImageMagick-7.0.7.34-3.79.1 SUSE Linux Enterprise Module for Development Tools 15-SP1 (src): ImageMagick-7.0.7.34-3.79.1 SUSE Linux Enterprise Module for Development Tools 15 (src): ImageMagick-7.0.7.34-3.79.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src): ImageMagick-7.0.7.34-3.79.1 SUSE Linux Enterprise Module for Desktop Applications 15 (src): ImageMagick-7.0.7.34-3.79.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0170-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1159861,1160369,1161194 CVE References: CVE-2019-19948,CVE-2019-19949 Sources used: openSUSE Leap 15.1 (src): ImageMagick-7.0.7.34-lp151.7.15.1
SUSE-SU-2020:0411-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1159861,1160369,1161194 CVE References: CVE-2019-19948,CVE-2019-19949 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP5 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Workstation Extension 12-SP4 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Server 12-SP5 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Server 12-SP4 (src): ImageMagick-6.8.8.1-71.141.1 SUSE Linux Enterprise Desktop 12-SP4 (src): ImageMagick-6.8.8.1-71.141.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done