Executive brief
GraphicsMagick, a widely used image processing library, contains a vulnerability in how it handles WPG image files. By providing a specially crafted image file with an oversized colormap, an attacker can cause the application to crash or potentially execute unauthorized code. This could lead to service outages or the compromise of systems that automatically process user-uploaded images.
Technical details
A heap-based buffer overflow exists in the WPG (WordPerfect Graphics) format reader of GraphicsMagick versions 1.3.25 and earlier. The vulnerability is rooted in a lack of bounds checking for colormap entries when the library is built with the default QuantumDepth=8 configuration. An attacker can exploit this by providing a WPG file containing a colormap with more than 256 entries, leading to a heap overflow. This can result in a crash (denial of service) or potentially remote code execution. The issue has been addressed in Debian security updates and subsequent GraphicsMagick releases.
Affected products
- GraphicsMagick GraphicsMagick 1.3.25 and earlier
Timeline
- 2016-10-07: disclosed: Vulnerability disclosed on oss-security mailing list
- 2016-12-24: patched: Debian released security update DSA-3746-1
- 2017-01-18: advisory: NVD published CVE-2016-7996 details