GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Sat Oct 06, 2018 7:26 pm Post subject: [ GLSA 201810-04 ] ImageMagick |
|
|
Gentoo Linux Security Advisory
Title: ImageMagick: Security hardening (GLSA 201810-04)
Severity: normal
Exploitable: local, remote
Date: 2018-10-06
Bug(s): #664236
ID: 201810-04
Synopsis
Due to multiple vulnerabilities in various coders used by
ImageMagick, Gentoo Linux now installs a policy.xml file which will
restrict coder usage by default.
Background
ImageMagick is a collection of tools and libraries for many image
formats.
Affected Packages
Package: media-gfx/imagemagick
Vulnerable: < 6.9.10.10-r1
Vulnerable: < 7.0.8.10-r1
Unaffected: >= 6.9.10.10-r1
Unaffected: >= 7.0.8.10-r1
Architectures: All supported architectures
Description
If you process an image with ImageMagick and don’t validate the file
before (e.g. check magic byte), ImageMagick will call any coders found in
the given file. So if ImageMagick will find Ghostscript for example, it
will call Ghostscript.
Due to multiple -dSAFER sandbox bypass vulnerabilities in Ghostscript,
this can lead to arbitrary code execution.
To mitigate this problem we install a policy.xml file by default which
will disable PS, EPS, PDF, and XPS coders.
Impact
A remote attacker, by enticing a user to process a specially crafted
image file, could execute arbitrary code with the privileges of the
process or cause a Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All ImageMagick 6 users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose
">=media-gfx/imagemagick-6.9.10.10-r1"
| All ImageMagick 7 users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose
">=media-gfx/imagemagick-7.0.8.10-r1"
|
References
Ghostscript contains
multiple -dSAFER sandbox bypass vulnerabilities (VU#332928)
|
|