An out-of-bounds buffer read flaw was found in the way ImageMagick, an image display and manipulation tool for the X Window System, retrieved source memory location by attempt to copy image bytes for certain TIFF image files. A remote attacker could provide a TIFF image with specially-crafted value of Exif IFD (set of tags for recording Exif-specific attribute information), which once opened in some ImageMagick tool would lead to the crash of that tool (denial of service).
Red Hat would like to thank CERT-FI for reporting this issue. CERT-FI acknowledges Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of Codenomicon's CROSS project as the original reporters.
This issue affects the versions of the ImageMagick package, as shipped with Fedora release of 15 and 16.
Public now via:
Created ImageMagick tracking bugs for this issue
Affects: fedora-all [bug 808159]
This issue affects the versions of the ImageMagick package, as shipped with Red Hat Enterprise Linux 6.
Rawhide build which should fix it http://koji.fedoraproject.org/koji/taskinfo?taskID=3977291.
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2012:0544 https://rhn.redhat.com/errata/RHSA-2012-0544.html