Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.

From Red Hat Security Advisory 2007:0015 :

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

This update fixes a broken patch for CVE-2006-5456 and minor non-security issues. (CVE-2007-0770)

Two security problems were found in GraphicsMagick which are also present in ImageMagick.

  - Multiple buffer overflows in ImageMagick allowed     user-assisted attackers to cause a denial of service and     possibly execute execute arbitrary code via (1) a DCM     image that is not properly handled by the ReadDCMImage     function in coders/dcm.c, or (2) a PALM image that is     not properly handled by the ReadPALMImage function in     coders/palm.c. (CVE-2006-5456)

Additionally a segfault regression when converting a PGM image was fixed on SLE 10.

Vladimir Nadvornik discovered that the fix for CVE-2006-5456, released in USN-372-1, did not correctly solve the original flaw in PALM image handling. By tricking a user into processing a specially crafted image with an application that uses imagemagick, an attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

M. Joonas Pihlaja discovered that ImageMagick did not sufficiently verify the validity of PALM and DCM images. When processing a specially crafted image with an application that uses imagemagick, this could be exploited to execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maintainance update fixing several security issues and bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security problems were found in GraphicsMagick which are also present in ImageMagick.

CVE-2006-5456: Multiple buffer overflows in ImageMagick allowed user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.

Additionaly a segfault regression when converting a PGM image was fixed on SLE 10.

A new imagemagick package is available for Slackware 11.0 to fix security issues.

Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.

Updated packages have been patched to correct these issues.

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200611-19 (ImageMagick: PALM and DCM buffer overflows)

    M. Joonas Pihlaja has reported that a boundary error exists within the     ReadDCMImage() function of coders/dcm.c, causing the improper handling     of DCM images. Pihlaja also reported that there are several boundary     errors in the ReadPALMImage() function of coders/palm.c, similarly     causing the improper handling of PALM images.
  Impact :

    An attacker could entice a user to open a specially crafted DCM or PALM     image with ImageMagick, and possibly execute arbitrary code with the     privileges of the user running ImageMagick.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200611-07 (GraphicsMagick: PALM and DCM buffer overflows)

    M. Joonas Pihlaja has reported that a boundary error exists within the     ReadDCMImage() function of coders/dcm.c, causing the improper handling     of DCM images. Pihlaja also reported that there are several boundary     errors in the ReadPALMImage() function of coders/palm.c, similarly     causing the improper handling of PALM images.
  Impact :

    An attacker could entice a user to open a specially crafted DCM or PALM     image with GraphicsMagick, and possibly execute arbitrary code with the     privileges of the user running GraphicsMagick.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in Imagemagick, a collection of image manipulation programs, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-0082     Daniel Kobras discovered that Imagemagick is vulnerable     to format string attacks in the filename parsing code.

  - CVE-2006-4144     Damian Put discovered that Imagemagick is vulnerable to     buffer overflows in the module for SGI images.

  - CVE-2006-5456     M Joonas Pihlaja discovered that Imagemagick is     vulnerable to buffer overflows in the module for DCM and     PALM images.

  - CVE-2006-5868     Daniel Kobras discovered that Imagemagick is vulnerable     to buffer overflows in the module for SGI images.

This update also addresses regressions in the XCF codec, which were introduced in the previous security update.

ID	Name	Product	Family	Severity
67439	Oracle Linux 3 / 4 : ImageMagick (ELSA-2007-0015)	Nessus	Oracle Linux Local Security Checks	high
29350	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2592)	Nessus	SuSE Local Security Checks	high
29348	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2239)	Nessus	SuSE Local Security Checks	medium
28014	Ubuntu 5.10 / 6.06 LTS / 6.10 : imagemagick vulnerabilities (USN-422-1)	Nessus	Ubuntu Local Security Checks	high
27953	Ubuntu 5.04 / 5.10 / 6.06 LTS / 6.10 : imagemagick vulnerability (USN-372-1)	Nessus	Ubuntu Local Security Checks	medium
27710	Fedora 7 : GraphicsMagick-1.1.8-2.fc7 (2007-1340)	Nessus	Fedora Local Security Checks	high
27107	openSUSE 10 Security Update : ImageMagick (ImageMagick-2585)	Nessus	SuSE Local Security Checks	high
27105	openSUSE 10 Security Update : ImageMagick (ImageMagick-2235)	Nessus	SuSE Local Security Checks	medium
27102	openSUSE 10 Security Update : GraphicsMagick (GraphicsMagick-2593)	Nessus	SuSE Local Security Checks	high
24792	Slackware 11.0 : imagemagick (SSA:2007-066-06)	Nessus	Slackware Local Security Checks	medium
24578	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:193)	Nessus	Mandriva Local Security Checks	medium
24363	RHEL 2.1 / 3 / 4 : ImageMagick (RHSA-2007:0015)	Nessus	Red Hat Local Security Checks	high
24357	CentOS 3 / 4 : ImageMagick (CESA-2007:0015)	Nessus	CentOS Local Security Checks	high
23727	GLSA-200611-19 : ImageMagick: PALM and DCM buffer overflows	Nessus	Gentoo Local Security Checks	medium
23672	GLSA-200611-07 : GraphicsMagick: PALM and DCM buffer overflows	Nessus	Gentoo Local Security Checks	medium
23662	Debian DSA-1213-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2006-5456

high

Tenable Plugins

high

high

medium

high

medium

high

high

medium

high

medium

medium

high

high

medium

medium

high