<<< Date Index >>>     <<< Thread Index >>>

FLEA-2007-0006-1: ImageMagick



Foresight Linux Essential Advisory: 2007-0006-1
Published: 2007-04-03

Rating: Minor

Updated Versions:
    ImageMagick=/foresight.rpath.org@fl:1-devel//1/6.3.3.5-1-1
    group-dist=/foresight.rpath.org@fl:1-devel//1/1.1-0.11-5[

References:
    https://issues.foresightlinux.org/browse/FL-222

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=496
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1719

Description:
Previous versions of the ImageMagick package were vulnerable to buffer overflows in the code which parses DCM and XWD files, which could allow an attacker to execute arbitrary code at the permission level of the user running ImageMagick (usually non-root). The attacker would have to convince a user to open the file in ImageMagick. While these file formats are not common, it is possible to disguise the file such that it appears to be a file of another, more common, type.