[go: up one dir, main page]
Bug 1051430 (CVE-2017-11754) - VUL-1: CVE-2017-11754: GraphicsMagick, ImageMagick: WritePICONImage in coders/xpm.c allows to cause DoS
Summary: VUL-1: CVE-2017-11754: GraphicsMagick, ImageMagick: WritePICONImage in coders...
Status: RESOLVED DUPLICATE of bug 1051412
Alias: CVE-2017-11754
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Petr Gajdos
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/189318/
Whiteboard: CVSSv3:SUSE:CVE-2017-11754:7.5:(AV:N/...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-31 08:20 UTC by Johannes Segitz
Modified: 2019-04-23 22:40 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Reproducer (2.00 KB, application/octet-stream)
2017-07-31 08:20 UTC, Johannes Segitz 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2017-07-31 08:20:18 UTC 
Created attachment 734515 [details]
Reproducer

CVE-2017-11754

The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows
remote attackers to cause a denial of service (memory leak) via a crafted file
that is mishandled in an OpenPixelCache call.

valgrind convert Memory-Leak-21_output_picon_1501391824.23 out.picon

Same reproducer as bsc#1051416, but CVE is assigned to a different issue triggered by it

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11754
https://github.com/ImageMagick/ImageMagick/issues/633
Comment 1 Petr Gajdos 2018-01-02 11:57:49 UTC 
With this additional testcase, I cannot reproduce any other memory leaks than that ones listed in bug 1051412, closing as duplicate as the upstream did.

*** This bug has been marked as a duplicate of bug 1051412 ***