Bug 155953

Summary:	CAN-2005-1275 ImageMagick PNM heap overflow
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	ImageMagick	Assignee:	Matthias Clasen <mclasen>
Status:	CLOSED ERRATA	QA Contact:	Mike McLean <mikem>
Severity:	high	Docs Contact:
Priority:	medium
Version:	4.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,public=20050424,source=gentoo,reported=20050425
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-25 16:14:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-04-26 01:30:29 UTC

A heap based buffer overflow exists in ImageMagick's PNM decoder.

http://www.overflow.pl/adv/imheapoverflow.txt

Here's exploit (in the event the website vanishes)
perl -e 'print "P7\n1\n1 1\n1"' > vuln.pnm

Comment 1 Josh Bressers 2005-04-26 14:03:42 UTC

This issue also affects RHEL3

Comment 2 Matthias Clasen 2005-04-26 14:50:03 UTC

6.0.7.1-11 contains the fix for RHEL4
5.5.6.14 for RHEL3

Comment 3 Josh Bressers 2005-05-25 16:14:05 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-413.html