CVE-2016-8862 in Ubuntu

CVE-2016-8862

Priority

Description

The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick
before 7.0.3.3 allows remote attackers to have unspecified impact via a
crafted image, which triggers a memory allocation failure.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8862
https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/
http://www.openwall.com/lists/oss-security/2016/10/17/4
https://usn.ubuntu.com/usn/usn-3142-1

Bugs

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845634

Notes

mdeslaur> the initial patch was incomplete and resulted in CVE-2016-8866
mdeslaur> This is 0171-Lowered-max-map_length-to-prevent-an-overflow-271.patch

Package

Source: imagemagick (LP Ubuntu Debian)

Upstream:	needs-triage
Ubuntu 14.04 LTS (Trusty Tahr):	released (8:6.7.7.10-6ubuntu3.3)
Ubuntu 16.04 LTS (Xenial Xerus):	released (8:6.8.9.9-7ubuntu5.3)

Patches:

Upstream:	https://github.com/ImageMagick/ImageMagick/commit/aea6c6507f55632829e6432f8177a084a57c9fcc
Upstream:	https://github.com/ImageMagick/ImageMagick/commit/ab2c9d6a8dd6d71b161ec9cc57a588b116b52322

More Information

Updated: 2018-10-31 21:24:44 UTC (commit cfa7cf69d76449ccff972ac22f40976a08d908c2)