Comment about commit https://github.com/ImageMagick/ImageMagick/commit/1737ac82b335e53376382c07b9a500d73dd2aa11

[bastien-roucaries]

Could you comment and give a statement about security about this commit ?

[bastien-roucaries]

Add also commit 948356e#diff-f47d172f1a179e52a8b2c231847f32ef

[bastien-roucaries]

529ff26#diff-cdb21e3ad4d6e304030bd19bdc881fce and b007dd3#diff-cdb21e3ad4d6e304030bd19bdc881fce

[bastien-roucaries]

This one 8c10b92#diff-0a5dc34e461f3c458e758c199f2dc46d

[mikayla-grace]

The JPEG coder patch is an extra precaution in the event that a JPEG scanline is short to prevent random bytes. This functionality is already covered if you enable this security policy:

<policy domain="system" name="memory-map" value="anonymous"/>

The check for blob size is a precaution against small JPEG images which could be corrupt but also could be possible exploits.

Enabling seekable streams is required to ensure checking the blob size works when an image is streamed on stdin. It was an oversight in the original patch.

The last patch prevents a possible memory leak in the event of a corrupt image.

[bastien-roucaries]

Did you ask for CVE ?

[mikayla-grace]

No. The users posting these potential flaws to Github issues generally request and post a CVE.

[fgeek]

Please use CVE-2017-11447 for:

The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service.

which is fixed with 8c10b92 commit.

Please use CVE-2017-11448 for:

The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.

which is fixed with 1737ac8 commit.

Please use CVE-2017-11449 for:

coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin.

which is fixed with 529ff26 and b007dd3 commits.

Please use CVE-2017-11450 for:

coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.

which is fixed with 948356e commit.