Joined: 17 Nov 2002
Location: Graz / EU
|Posted: Wed Jan 26, 2005 8:51 pm Post subject: [ GLSA 200501-37 ] GraphicsMagick: PSD decoding heap overflo
|Gentoo Linux Security Advisory
Title: GraphicsMagick: PSD decoding heap overflow (GLSA 200501-37)
Date: January 26, 2005
GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop
Document (PSD) files, which could lead to arbitrary code execution.
GraphicsMagick is a collection of tools to read, write and
manipulate images in many formats. GraphicsMagick is originally derived
from ImageMagick 5.5.2.
Vulnerable: < 1.1.5
Unaffected: >= 1.1.5
Architectures: All supported architectures
Andrei Nigmatulin discovered that handling a Photoshop Document
(PSD) file with more than 24 layers in ImageMagick could trigger a heap
overflow (GLSA 200501-26). GraphicsMagick is based on the same code and
therefore suffers from the same flaw.
An attacker could potentially design a malicious PSD image file to
cause arbitrary code execution with the permissions of the user running
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.5"
Last edited by GLSA on Mon Jun 10, 2013 4:19 am; edited 2 times in total