Bug 1004648 (CVE-2013-4298)

Summary:	CVE-2013-4298 ImageMagick: One-byte heap-based buffer overflow when decoding certain GIF images
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	btissoir, jkurik, nmurray, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-09-05 07:05:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1002835

Description Huzaifa S. Sidhpurwala 2013-09-05 06:58:56 UTC

A heap-based buffer overflow was reported in ImageMagick, when decoding certain GIF images, with specially crafted blocks. A remote attacker could provide a specially-crafted GIF image format file, that when processed by ImageMagick would lead to crash or, potentially, arbitrary code execution.

References:

https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721273
https://launchpadlibrarian.net/148688866/Fix-gif-comments.patch

Upstream patch:

http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c

Comment 1 Huzaifa S. Sidhpurwala 2013-09-05 07:01:46 UTC

Looking at the source, it seems like this flaw was introduced by the following commit:

http://trac.imagemagick.org/changeset/8002/ImageMagick/trunk/coders/gif.c

versions of ImageMagick shipped with rhel-5,rhel-6,rhel-7 and fedora are not vulnerable.

Comment 2 Huzaifa S. Sidhpurwala 2013-09-05 07:04:33 UTC

Statement:

Not Vulnerable. This issue does not affect the version of ImageMagick as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 3 Huzaifa S. Sidhpurwala 2013-09-05 07:05:54 UTC

This issue does not affect the version of ImageMagick as shipped with Fedora 18 and Fedora 19.