GraphicsMagick 1.3.26 vulnerabilities

In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region.

In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8.

In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation.

GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.

GraphicsMagick 1.3.26 has a vulnerability in the ReadCMYKImage function in coders/cmyk.c that allows for a heap-based buffer over-read via a crafted file.

GraphicsMagick 1.3.26 has a heap-based buffer over-read vulnerability in the WriteOnePNGImage function in coders/png.c, which can be exploited via a crafted file.

GraphicsMagick 1.3.26 has a vulnerability in the ReadRGBImage function in coders/rgb.c that allows for a heap-based buffer over-read via a crafted file.

The WritePNMImage function in coders/pnm.c in GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow, leading to application crashes.

GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.

The DrawImage function in GraphicsMagick 1.3.26 does not properly handle pop keywords associated with push keywords, potentially leading to application crashes or denial of service.

The ReadWPGImage function in GraphicsMagick 1.3.26 does not properly validate colormapped images, which may lead to application crashes or denial of service.

GraphicsMagick version 1.3.26 is vulnerable to a heap-based buffer overflow found in the DescribeImage() function in the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.

In GraphicsMagick 1.3.26, a Null Pointer Dereference occurs in the ReadOneJNGImage function while transferring JPEG scanlines, related to a PixelPacket pointer.

GraphicsMagick 1.3.26 has a use-after-free issue in the ReadOneJNGImage function in coders/png.c when the height or width is zero, related to ReadJNGImage.

The ReadJNGImage and ReadOneJNGImage functions in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, allowing remote attackers to conduct use-after-free attacks via a crafted file.

In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.

The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.

The ReadWMFImage function in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.

The ReadMNGImage function in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function.

GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11638.

GraphicsMagick version 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image. This is a different vulnerability than CVE-2017-11642.

The ReadMNGImage function in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file.

The ReadOneJNGImage function in GraphicsMagick 1.3.26 allows remote attackers to cause an application crash during JNG reading via a zero-length color_image data structure.

The MagickMalloc function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a 'file truncation error for corrupt file.'

The ReadPCXImage function in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, triggering a memory allocation failure and a file truncation error for corrupt file.

The ReadSCTImage function in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.

The TIFFGetField function in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a file containing an 'unterminated' string.

The Utah RLE reader in GraphicsMagick before version 1.3.25 allows remote attackers to cause a denial of service via vectors involving the header information and the file size.

The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.

GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.

GraphicsMagick version 1.3.26 has a memory leak in the PersistCache function in magick/pixel_cache.c during the writing of Magick Persistent Cache (MPC) files.

GraphicsMagick version 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.

GraphicsMagick version 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames with non-identical widths.

GraphicsMagick version 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.

Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before version 1.3.25 can be exploited by remote attackers.

Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. This vulnerability exists due to an incomplete patch for CVE-2016-2317.

A heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers.