Executive brief
GraphicsMagick, a widely used image processing library, contains a flaw in how it handles WPG image files. An attacker can provide a specially crafted image that causes the software to crash, leading to a denial of service. This could disrupt business operations for any service that automatically processes user-uploaded images.
Technical details
A NULL pointer dereference vulnerability exists in the WPG (WordPerfect Graphics) format reader of GraphicsMagick versions 1.3.25 and earlier. The issue is rooted in a logic error within the ReferenceBlob function where a NULL pointer is passed to a component that does not allow it, triggering an assertion failure. A remote attacker can exploit this by submitting a maliciously crafted WPG file for processing. Successful exploitation results in an immediate application crash (Denial of Service). This vulnerability was discovered via fuzzing with American Fuzzy Lop (AFL). Patches were made available in late 2016, with fixes included in Debian security updates and subsequent GraphicsMagick releases.
Affected products
- GraphicsMagick Group GraphicsMagick 1.3.25 and earlier
Timeline
- 2016-10-07: disclosed: Public disclosure on oss-security mailing list
- 2016-12-24: patched: Debian released security update DSA-3746-1
- 2017-01-18: advisory: NVD publication date