RHSA-2005:413-01: Important: ImageMagick security update

Posted by Philipp Esselbach on: 05/25/2005 03:15 PM [ Print | 0 comment(s) ]

An ImageMagick security update is available for Red Hat Enterprise Linux

----------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Important: ImageMagick security update
Advisory ID: RHSA-2005:413-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-413.html
Issue date: 2005-05-25
Updated on: 2005-05-25
Product: Red Hat Enterprise Linux
----------------------------------------------------------------------

1. Summary:

Updated ImageMagick packages that fix a buffer overflow issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

ImageMagick(TM) is an image display and manipulation tool for the X Window System which can read and write multiple image formats.

A heap based buffer overflow bug was found in the way ImageMagick parses PNM files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted PNM file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1275 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

155953 - ImageMagick PNM heap overflow

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm

ppc:
61a882a1ddc43197c44d8d807cebf87e ImageMagick-5.5.6-14.ppc.rpm
dde736a8747a93350ce8b9b353efc045 ImageMagick-5.5.6-14.ppc64.rpm
2d52336caaee183028cb16b20355e211 ImageMagick-c++-5.5.6-14.ppc.rpm
7338bc1e2d2643643a303d1bc281b2e5 ImageMagick-c++-5.5.6-14.ppc64.rpm
f1706007d999b409a388abe831654304 ImageMagick-c++-devel-5.5.6-14.ppc.rpm
03c49c0f386233a7bd3ca3246183b829 ImageMagick-devel-5.5.6-14.ppc.rpm
6f11c4e4e528afad0a31a520cb0f5c6e ImageMagick-perl-5.5.6-14.ppc.rpm

s390:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
e45c1f6c0efcc5f0496f5242b5a3ad7e ImageMagick-c++-devel-5.5.6-14.s390.rpm
31d0312826495ad73bd9c18437460798 ImageMagick-devel-5.5.6-14.s390.rpm
9b1a819b54830642d5d782643119f440 ImageMagick-perl-5.5.6-14.s390.rpm

s390x:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
db045788fbb9b484851461dc669dc1c7 ImageMagick-5.5.6-14.s390x.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
c4d3572cc9850c59c7628a6c90cf4b4f ImageMagick-c++-5.5.6-14.s390x.rpm
f53ece28b83e8ffec6443e814ea3e60c ImageMagick-c++-devel-5.5.6-14.s390x.rpm
85770ab54225df2d09fb59f09541ff98 ImageMagick-devel-5.5.6-14.s390x.rpm
b87f2ea0d97e4de04f2e6680474cecb8 ImageMagick-perl-5.5.6-14.s390x.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm

ppc:
69353fd54da027ea07f25980c3ce0d89 ImageMagick-6.0.7.1-11.ppc.rpm
c0ce1b96e65429e8a8c2d0bc18e096ad ImageMagick-c++-6.0.7.1-11.ppc.rpm
e47a22ced559637dd65ae48d0ea4bd94 ImageMagick-c++-devel-6.0.7.1-11.ppc.rpm
9bb71a4406621cade0cb8170b5a9b671 ImageMagick-devel-6.0.7.1-11.ppc.rpm
c16ba0ddbc52bb5e79a7640e486704b9 ImageMagick-perl-6.0.7.1-11.ppc.rpm

s390:
c66d6d3557835a4f8759bcaaae283b61 ImageMagick-6.0.7.1-11.s390.rpm
fe50719d170010c9d389ce15d0a0e3fe ImageMagick-c++-6.0.7.1-11.s390.rpm
89f4a1a0ad454633b41654a717655b07 ImageMagick-c++-devel-6.0.7.1-11.s390.rpm
088f61ea3fd8733c00844ec4660c3940 ImageMagick-devel-6.0.7.1-11.s390.rpm
fa51ebe0d878e5079fa76e786bddc9c6 ImageMagick-perl-6.0.7.1-11.s390.rpm

s390x:
cc0d06a7e8de3d95b37b000bc9cb15b2 ImageMagick-6.0.7.1-11.s390x.rpm
6f823f887bd8b673630b2519081d31a7 ImageMagick-c++-6.0.7.1-11.s390x.rpm
a20512111f65942066441db7a11597df ImageMagick-c++-devel-6.0.7.1-11.s390x.rpm
1cc6804b0b87aabfc2c01366c015c496 ImageMagick-devel-6.0.7.1-11.s390x.rpm
30fcc8201ae8a66fd6a72ec4f37b2883 ImageMagick-perl-6.0.7.1-11.s390x.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

7. References:

http://www.overflow.pl/adv/imheapoverflow.txt

8. Contact:

The Red Hat security contact is lt;secalert@redhat.comgt;. More contact details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.