National Cyber-Alert System

Vulnerability Summary for CVE-2006-5456

Overview

Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

This vulnerability is addressed in the following product release: GraphicsMagick, GraphicsMagick, 1.1.7 Unable to identify a patch for ImageMagick.}

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210921

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210921

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-811

Hyperlink:https://issues.rpath.com/browse/RPL-811

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1034

Hyperlink:https://issues.rpath.com/browse/RPL-1034

External Source: XF

Name: imagemagick-graphicsmagick-palm-bo(29816)

Hyperlink:http://xforce.iss.net/xforce/xfdb/29816

External Source: UBUNTU

Name: USN-422-1

Hyperlink:http://www.ubuntu.com/usn/usn-422-1

External Source: UBUNTU

Name: USN-372-1

Hyperlink:http://www.ubuntu.com/usn/usn-372-1

External Source: BID

Name: 20707

Hyperlink:http://www.securityfocus.com/bid/20707

External Source: BUGTRAQ

Name: 20070208 rPSA-2007-0029-1 ImageMagick

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/459507/100/0/threaded

External Source: BUGTRAQ

Name: 20061127 rPSA-2006-0218-1 ImageMagick

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/452718/100/100/threaded

External Source: REDHAT

Name: RHSA-2007:0015

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0015.html

External Source: OSVDB

Name: 29990

Hyperlink:http://www.osvdb.org/29990

External Source: SUSE

Name: SUSE-SR:2007:003

Hyperlink:http://www.novell.com/linux/security/advisories/2007_3_sr.html

External Source: SUSE

Name: SUSE-SA:2006:066

Hyperlink:http://www.novell.com/linux/security/advisories/2006_66_imagemagick.html

External Source: VUPEN

Name: ADV-2006-4171

Hyperlink:http://www.frsirt.com/english/advisories/2006/4171

External Source: VUPEN

Name: ADV-2006-4170

Hyperlink:http://www.frsirt.com/english/advisories/2006/4170

External Source: DEBIAN

Name: DSA-1213

Hyperlink:http://www.debian.org/security/2006/dsa-1213

External Source: SLACKWARE

Name: SSA:2007-066-06

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.352092

External Source: GENTOO

Name: GLSA-200611-19

Hyperlink:http://security.gentoo.org/glsa/glsa-200611-19.xml

External Source: GENTOO

Name: GLSA-200611-07

Hyperlink:http://security.gentoo.org/glsa/glsa-200611-07.xml

External Source: SECUNIA

Name: 24458

Hyperlink:http://secunia.com/advisories/24458

External Source: SECUNIA

Name: 24196

Hyperlink:http://secunia.com/advisories/24196

External Source: SECUNIA

Name: 24186

Hyperlink:http://secunia.com/advisories/24186

External Source: SECUNIA

Name: 23121

Hyperlink:http://secunia.com/advisories/23121

External Source: SECUNIA

Name: 23090

Hyperlink:http://secunia.com/advisories/23090

External Source: SECUNIA

Name: 22998

Hyperlink:http://secunia.com/advisories/22998

External Source: SECUNIA

Name: 22834

Hyperlink:http://secunia.com/advisories/22834

External Source: SECUNIA

Name: 22819

Hyperlink:http://secunia.com/advisories/22819

External Source: SECUNIA

Name: 22604

Hyperlink:http://secunia.com/advisories/22604

External Source: SECUNIA

Name: 22601

Hyperlink:http://secunia.com/advisories/22601

External Source: SECUNIA

Name: 22572

Hyperlink:http://secunia.com/advisories/22572

External Source: SECUNIA

Name: 22569

Hyperlink:http://secunia.com/advisories/22569

External Source: CONFIRM

Name: http://packages.debian.org/changelogs/pool/main/g/graphicsmagick/graphicsmagick_1.1.7-9/changelog#versionversion1.1.7-9

Hyperlink:http://packages.debian.org/changelogs/pool/main/g/graphicsmagick/graphicsmagick_1.1.7-9/changelog#versionversion1.1.7-9

External Source: MANDRIVA

Name: MDKSA-2007:041

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:041

External Source: MANDRIVA

Name: MDKSA-2006:193

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:193

External Source: MANDRIVA

Name: MDKSA-2007:041

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:041

External Source: MANDRIVA

Name: MDKSA-2006:193

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:193

External Source: SECUNIA

Name: 24284

Hyperlink:http://secunia.com/advisories/24284

External Source: SGI

Name: 20070201-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc