Heap-based buffer overflow in the libMagick component of ImageMagick 6.0.6.2 might allow attackers to execute arbitrary code via an image index array that triggers the overflow during filename glob expansion by the ExpandFilenames function.

From Red Hat Security Advisory 2007:0015 :

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

Several remote vulnerabilities have been discovered in Imagemagick, a collection of image manipulation tools, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2440     Eero Hakkinen discovered that the display tool     allocates insufficient memory for globbing patterns,     which might lead to a buffer overflow.

  - CVE-2006-3743     Tavis Ormandy from the Google Security Team discovered     that the Sun bitmap decoder performs insufficient input     sanitising, which might lead to buffer overflows and the     execution of arbitrary code.

  - CVE-2006-3744     Tavis Ormandy from the Google Security Team discovered     that the XCF image decoder performs insufficient input     sanitising, which might lead to buffer overflows and the     execution of arbitrary code.

The delegate code in ImageMagick 6.2.4.x allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command. (CVE-2005-4601)

A format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3, and other versions, allows user-complicit attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program. (CVE-2006-0082)

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
67439	Oracle Linux 3 / 4 : ImageMagick (ELSA-2007-0015)	Nessus	Oracle Linux Local Security Checks	high
24363	RHEL 2.1 / 3 / 4 : ImageMagick (RHSA-2007:0015)	Nessus	Red Hat Local Security Checks	high
24357	CentOS 3 / 4 : ImageMagick (CESA-2007:0015)	Nessus	CentOS Local Security Checks	high
22710	Debian DSA-1168-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	high
20818	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:024)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2006-2440

high

Tenable Plugins

high

high

high

high

high