Bug 1772643 (CVE-2017-11166)
| Summary: | CVE-2017-11166 ImageMagick: memory leak vulnerability in ReadXWDImage function in coders/xwd.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | fedora, jhorak, mike, pahan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ImageMagick 7.0.5-6, ImageMagick 6.9.8-1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-31 22:35:54 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1772644, 1772645, 1780465 | ||
| Bug Blocks: | 1772646 | ||
|
Description
Guilherme de Almeida Suckevicz
2019-11-14 19:42:04 UTC
Created ImageMagick tracking bugs for this issue: Affects: epel-8 [bug 1772645] Affects: fedora-all [bug 1772644] Analysis: This is essentially memory leak, resulting in memory exhaustion and maybe crash. Upstream commit: https://github.com/ImageMagick/ImageMagick/commit/5964475e21e7e3bdd27835b71aa17d1678c21d7c This is an issue from 2017. Please read that again - the year 2017. This issue is 2 years old. Why was this issue opened? Fedora ships up to date copies of ImageMagick 6, which means this CVE is fixed. Please fix your scripts that create these bugs. This is not the first very old bug to be opened. I am no longer going to reply as they are spam to my inbox. ImageMagick 7 commit: https://github.com/ImageMagick/ImageMagick/commit/31b842a218225cd7feddf65cbccf9d783c6cb526 ImageMagick 6 commit: https://github.com/ImageMagick/ImageMagick6/commit/5964475e21e7e3bdd27835b71aa17d1678c21d7c This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1180 https://access.redhat.com/errata/RHSA-2020:1180 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2017-11166 |