[SECURITY] [DSA 1260-1] New imagemagick package fix arbitrary code execution

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] [DSA 1260-1] New imagemagick package fix arbitrary code execution
From: Moritz Muehlenhoff <jmm@xxxxxxxxxx>
Date: Wed, 14 Feb 2007 22:04:27 +0100
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mail-followup-to: bugtraq@xxxxxxxxxxxxxxxxx
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Old-return-path: <jmm@xxxxxxxxxx>
Priority: urgent
Reply-to: listadmin@xxxxxxxxxxxxxxxxx
Resent-cc: recipient list not shown: ;
Resent-date: Wed, 14 Feb 2007 15:04:36 -0600 (CST)
Resent-from: list@xxxxxxxxxxxxxxxxx (Mailing List Manager)
Resent-message-id: <DUawDB.A.XsH.kl30FB@murphy>
User-agent: Mutt/1.5.13 (2006-08-11)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1260-1                    security@xxxxxxxxxx
http://www.debian.org/security/                         Moritz Muehlenhoff
February 14th, 2007                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : imagemagick
Vulnerability  : buffer overflow
Problem-Type   : local(remote)
Debian-specific: no
CVE ID         : CVE-2007-0770

Vladimir Nadvornik discovered that the fix for a vulnerability in the
PALM decoder of Imagemagick, a collection of image manipulation programs,
was ineffective. To avoid confusion a new CVE ID has been assigned;
tha original issue was tracked as CVE-2006-5456.

For the stable distribution (sarge) this problem has been fixed in
version 6:6.0.6.2-2.9.

For the upcoming stable distribution (etch) this problem has been
fixed in version 7:6.2.4.5.dfsg1-0.14.

For the unstable distribution (sid) this problems has been fixed in
version 7:6.2.4.5.dfsg1-0.14.

We recommend that you upgrade your imagemagick packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9.dsc
      Size/MD5 checksum:      881 7a9c72b09064a000b21fb7f1c188f58b
    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9.diff.gz
      Size/MD5 checksum:   142091 882c6b166d02a3afcf7b65b935053141
    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2.orig.tar.gz
      Size/MD5 checksum:  6824001 477a361ba0154cc2423726fab4a3f57c

  Alpha architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:  1473132 a64722b75a6727372eab8c5a8e9d3460
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:   173936 73ad6aba77ddd80a1fa1bf9cb6838a6a
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:   288822 6a29717cdc16bc5f7dc3527b3c04a32e
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:  1284370 7fe43e1953d01bfd1f40e743b43828e5
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:  2200348 183f4d885fb0f0aa298f80ae689eb068
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_alpha.deb
      Size/MD5 checksum:   234798 1e536b98cce30203535a21a110effc66

  AMD64 architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:  1466442 cce61a586a2c5456e5cd9998f503dff1
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:   163710 f0c6e48b31063d20aad8d6801f7b01dd
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:   228834 c0e8f73804537f75df7260ff692e0cb6
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:  1195150 0162e13544100058faee672fd672bcfd
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:  1550468 07ae791a2fbccd31ea48bb425552308f
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_amd64.deb
      Size/MD5 checksum:   231912 ffe6aa0bc71cb5b1f367864fd94c9c0c

  ARM architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:  1466166 7a8b57092ad8fcb15ff9ac69e94f79a6
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:   149436 f60d0449d25c294c8a9e5b111ee0dd73
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:   234946 fc0b7d343929740700a12af92014f7b7
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:  1204686 888ae3ff5955c8d4ba9635d2b0333357
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:  1647748 b0ebfaba0393ad3d17cc08417e16f4f6
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_arm.deb
      Size/MD5 checksum:   230598 febfdf6b1e489ce6e9c5c195eea4d099

  HP Precision architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:  1468434 91af04f67f24aa210f9751b23b44f1a0
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:   182294 22ff85bb71aa67ec2dfd07c08698a95e
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:   274036 2832f545f069276518a6cd91658ab495
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:  1404890 80a6f5944d0be3209f1fdeed9de3c1ae
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:  1827916 94b36feb9f8fcb3b9262d9725652e5cf
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_hppa.deb
      Size/MD5 checksum:   243918 8bbc8f0b106e7fc8160801f5e9ed4c6f

  Intel IA-32 architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:  1466158 b12fb2db8d713c7d09609ce761ce511f
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:   164504 12ffd60f5fc6c51a85016a1ebdc75d53
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:   209010 9aeebaf3983a8bdaad0bb762609054ed
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:  1172338 58922d27e7184a30fcdf5de44ddf9e7c
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:  1507592 8b8d72379bacb85839b4bbf7f2d4a1b4
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_i386.deb
      Size/MD5 checksum:   234080 7ef93e742172c9a342acc2a913b65520

  Intel IA-64 architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:  1468502 0a7887202d57741c8c3be4b2dce958e2
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:   188402 3ade807b07759f05c264885efb99419e
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:   296008 82f76c8876488eca4f4818abb3d5edb4
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:  1605664 ebf2610607abc6410b09dc239c382c90
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:  2132678 5fd5d6101764eb020ae46945e52a11ed
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_ia64.deb
      Size/MD5 checksum:   273596 a13f4b344a84d94fa360162225b93c10

  Motorola 680x0 architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:  1466216 6b3c7f12eb188ac46fc20fd1ffa9dfa8
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:   160146 b466183701680d1216ca13823170430d
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:   210812 dc5096668fe53c84e1675f7ae361f94b
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:  1073380 f5a339d2de04dc2f7de490de29ca2f4c
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:  1288946 33ca416bee60fa710c8efe906ad58a60
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_m68k.deb
      Size/MD5 checksum:   227038 017265076e92de6c95130780e7ca9dcd

  Big endian MIPS architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:  1490302 79e518fceb087b30d2a1c14bd60b8691
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:   155602 f77792a9077082ff893900446d286be4
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:   254920 8fb4d82e2f40d41c7eb7418b0f43a3d1
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:  1119298 0458271acc8b9925db07ad48e184f058
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:  1704528 30f1e7b3b9fa83719e9b3952c6c502a7
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_mips.deb
      Size/MD5 checksum:   131418 3e77636bb19daed6ed119a627b0ce504

  Little endian MIPS architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:  1490274 8baafda5b96b876517b06eafacbf895b
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:   151714 09ef6d0f126ca139d69289799d7fb895
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:   250164 b65ca0ed3b5f040f5d78a5fbdb1d5563
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:  1114890 6c47dc9a27e98b670e31e5a6aa8e6daf
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:  1668004 469c0f05098b4a8ec6a265632ba950bd
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_mipsel.deb
      Size/MD5 checksum:   131020 4fb92c9bb3f4d4f5caaa039b646aa9af

  PowerPC architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:  1471882 8d3e9a8bf55a29112ef3cdf6bf9e12e9
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:   156866 d1ee7717bade0bf2cfd1286ec8f9dae8
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:   227822 43e65023fad784aca3c2061703f4dbb8
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:  1169594 e428dda6c063b60ed3f90ba25aaf5194
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:  1684924 03e88e7f8158add8558bb4cfc0b413eb
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_powerpc.deb
      Size/MD5 checksum:   270638 27a8eaacfee84ee0103bd58f817f8cbb

  IBM S/390 architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:  1467688 e30f5f259bbfb5855468c4ca165eb311
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:   180574 bd3a78a00b618c09182631011cca8455
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:   230292 0e052ebfd74856a77ec7815567b581bd
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:  1194348 558ea25312ff8ec8a39001f87f4c2f2d
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:  1531000 a11c3e26b1d6cb2110a1eb454874b990
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_s390.deb
      Size/MD5 checksum:   242192 7180ca4868abbead48a65de84d74caf9

  Sun Sparc architecture:

    
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:  1465752 1b7a5126b7ab981ba3cb2ba840405ecb
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:   161160 fe14a3bf7df9231eef3931dffa190882
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:   224424 b12e563f9c3f33fe4599cb3343387477
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:  1249364 9fc7b5dbfd4a964443cead1d34bf1649
    
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:  1684558 4ca62128d73a9bf8a1b8c680195da801
    
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_sparc.deb
      Size/MD5 checksum:   231044 3a630dd561970f121708553c6262e1d9

  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFF03kSXm3vHE4uyloRAu5qAKCjS8ZrdUaOQdrbGlMXIVxrJheBZACeOhkc
W+Ah8dUvx+7B1cNPQa6dyNQ=
=e+ks
-----END PGP SIGNATURE-----
Prev by Date: RE: Re[2]: Solaris telnet vulnberability - how many on your network?
Next by Date: Re: Solaris telnet vulnberability - how many on your network?
Previous by thread: Re: [SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure
Next by thread: Firefox: serious cookie stealing / same-domain bypass vulnerability
Index(es):
- Date
- Thread