Bug 192279

Summary:	CVE-2006-2440 ImageMagick heap overflow
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	ImageMagick	Assignee:	Norm Murray <nmurray>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	5	CC:	deisenst
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	public=20060102,source=cve,impact=low,reported=20060518
Fixed In Version:	ImageMagick-6.2.5.4-4.2.1.fc5.2 and ImageMagick-6.2.2.0-3.fc4.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-10-13 11:54:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-05-18 18:51:55 UTC

ImageMagick heap overflow

ImageMagick's DisplayImageCommand contains a heap overflow flaw.  It
is possible to pass an unexpanded glob to ImageMagick which will be
expanded by ImageMagick and overflow heap memory.

The patch and more information can be found in the Debian bug:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345595


This issue also affects FC4

Comment 1 Fedora Update System 2006-05-24 23:30:03 UTC

ImageMagick-6.2.5.4-4.2.1.fc5.2 has been pushed for fc5, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.

Comment 2 David Eisenstein 2006-10-13 11:54:26 UTC

This bug also seems to track the fc4 version of ImageMagick.

As noted above, ImageMagick-6.2.5.4-4.2.1.fc5.2 was pushed to updates for fc5.
<http://www.redhat.com/archives/fedora-package-announce/2006-May/msg00125.html>.

Also, ImageMagick-6.2.2.0-3.fc4.2 was pushed to updates for fc4.
<http://www.redhat.com/archives/fedora-package-announce/2006-May/msg00124.html>.

For some reason, when these were pushed (by Matthias Clasen?), this bug was
not closed, even though it appears that the Fedora Updates System posted news
of the fc5 version in comment #1.

Closing, ERRATA.