[arch-security] [Arch Linux Security Advisory ASA-201411-12] imagemagick: denial of service

[Remi Gacogne]

Arch Linux Security Advisory ASA-201411-12
==========================================

Severity: Low
Date    : 2014-11-13
CVE-ID  : CVE-2014-8716
Package : imagemagick
Type    : denial of service
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE-2014

Summary
=======

The package imagemagick before version 6.8.9.10-1 is vulnerable to
denial of service.

Resolution
==========

Upgrade to 6.8.9.10-1.

# pacman -Syu "imagemagick>=6.8.9.10-1"

The problem has been fixed upstream in version 6.8.9.10.

Workaround
==========

None.

Description
===========

Converting some specially crafted jpeg with convert could lead to a dos.

Impact
======

An attacker capable of submitting a specially crafted jpeg passed to the
convert command would be able to cause a crash resulting from an
out-of-bound read.

References
==========

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8716
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26456
http://seclists.org/oss-sec/2014/q4/569

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20141113/5497066b/attachment.bin>