Bug 2023196 (CVE-2021-3962) - CVE-2021-3962 ImageMagick: heap-use-after-free in at dcm.c RelinquishDCMMemory
Summary: CVE-2021-3962 ImageMagick: heap-use-after-free in at dcm.c RelinquishDCMMemory
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2021-3962
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2023211 2023411
Blocks: 2021961 2024125
TreeView+ depends on / blocked
 
Reported: 2021-11-15 07:55 UTC by Sandipan Roy
Modified: 2021-11-25 15:56 UTC (History)
10 users (show)

Fixed In Version: ImageMagick 7.1.0-15
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-11-25 15:56:24 UTC
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2021-11-15 07:55:34 UTC 
ImageMagick: heap-use-after-free in at dcm.c RelinquishDCMMemory

https://github.com/ImageMagick/ImageMagick/issues/4446
Comment 1 Sandipan Roy 2021-11-15 08:37:35 UTC 
Created ImageMagick tracking bugs for this issue:

Affects: fedora-all [bug 2023211]
Comment 4 Sandipan Roy 2021-11-15 16:13:35 UTC 
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2023411]
Comment 8 msiddiqu 2021-11-23 04:24:27 UTC 
References: 
 
https://github.com/ImageMagick/ImageMagick/commit/82775af03bbb10a0a1d0e15c0156c75673b4525e
https://github.com/ImageMagick/ImageMagick/issues/4446
Comment 9 Sergio Basto 2021-11-23 12:05:53 UTC 
ImageMagick6 don't have that codification only ImageMagick7

https://github.com/ImageMagick/ImageMagick6/blob/main/coders/dcm.c#L3978
Comment 10 msiddiqu 2021-11-24 04:17:35 UTC 
In reply to comment #9:
> ImageMagick6 don't have that codification only ImageMagick7
> 
> https://github.com/ImageMagick/ImageMagick6/blob/main/coders/dcm.c#L3978

It does look like that.

The issue was fixed in 7.1.0-16 7.1.0-15 7.1.0-14
imagemagick-6 seem to be notaffected.
Comment 12 msiddiqu 2021-11-24 04:54:06 UTC 
In reply to comment #10:
> In reply to comment #9:
> > ImageMagick6 don't have that codification only ImageMagick7
> > 
> > https://github.com/ImageMagick/ImageMagick6/blob/main/coders/dcm.c#L3978
> 
> It does look like that.
> 
> The issue was fixed in 7.1.0-16 7.1.0-15 7.1.0-14
> imagemagick-6 seem to be notaffected.

* Correction, based on the above comment and analysis, the fixed version is ImageMagick 7.1.0-15
Note You need to log in before you can comment on or make changes to this bug.