Bug 235071 (CVE-2007-1797)
Created attachment 151594 [details] Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-4, RHEL-5, FC-5 and FC-6) Created attachment 151595 [details] Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-3) Created attachment 151596 [details] Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1) Patches are slightly incorrect. RHEL 2.1 and RHEL 3 - need 3 args to ThrowReaderException and don't have AcquireMagickMemory. All patches have a memory leak in the first hunk of the xwd.c patch as they weren't removing the old memory allocation for comment, just adding a new one at the end of their insertion. Created attachment 277491 [details] Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-3) Created attachment 277501 [details] 151596: Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1) Reporter changed to security-response-team by request of Jay Turner. This has been fixed. |
Description of problem: According to an iDefense advisory (see the URL), ImageMagick is vulnerable to heap overflow flaws that can be triggered with crafted DCM and XWD files and exploited to execute arbitrary code. Version-Release number of selected component (if applicable): FC6 (6.2.8.0-3.fc6.1) FC5 (6.2.5.4-4.2.1.fc5.7) RHEL5 (6.2.8.0-3.el5.4) RHEL4 (6.0.7.1-17) RHEL3 (5.5.6-25) RHEL2.1 (5.3.8-18) How reproducible: Reproducers are not available at the time. Additional info: There are actually three bugs, one in DCM coder and two in XWD. I attach my attempt to backport the fixes.