Bug 1700755 (CVE-2019-10650)

Summary:	CVE-2019-10650 ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	andreas, fedora, jhorak, klember, mike, pahan, rdieter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ImageMagick 6.9.10-36, ImageMagick 7.0.8-36	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-31 22:33:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1701107, 1701108, 1701109, 1701110
Bug Blocks:	1700756

Description msiddiqu 2019-04-17 10:27:49 UTC

In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. 

Upstream issue:

https://github.com/ImageMagick/ImageMagick/issues/1532

Upstream patch:

https://github.com/ImageMagick/ImageMagick6/commit/d8d844c6f23f4d90d8fe893fe9225dd78fc1e6ef

Comment 1 msiddiqu 2019-04-17 10:33:34 UTC

References:

https://bugs.mageia.org/show_bug.cgi?id=24614

Comment 2 Huzaifa S. Sidhpurwala 2019-04-18 06:09:37 UTC

Analysis:

Essentially a heap-based OOB read which can crash the application while reading specially crafted TIFF files. Seems like crash or DoS is the maximum impact, no easy way to read bits of OOB memory in this case.

Comment 3 Huzaifa S. Sidhpurwala 2019-04-18 06:16:32 UTC

Created GraphicsMagick tracking bugs for this issue:

Affects: epel-all [bug 1701109]
Affects: fedora-all [bug 1701108]


Created ImageMagick tracking bugs for this issue:

Affects: fedora-all [bug 1701107]

Comment 5 Tomas Hoger 2020-03-25 19:47:52 UTC

ImageMagick 7 commit:

https://github.com/ImageMagick/ImageMagick/commit/b0fe1aa7c2ed7becb892f121abdd68a6e6e0ce0b

Comment 6 errata-xmlrpc 2020-03-31 19:32:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1180 https://access.redhat.com/errata/RHSA-2020:1180

Comment 7 Product Security DevOps Team 2020-03-31 22:33:54 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10650