A local buffer overflow exists in ImageMagick. The application fails to check boundary conditions in the 'ReadPALMImage()' function resulting in a heap overflow. With a specially crafted request, an attacker can cause a denial of service and possibly execution of arbitrary code, resulting in a loss of availability. In order to exploit this issue an attacker has to persuade the victim to open a malformed PALM image.
Classification
Location:
Local Access Required
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
Technical
Due to a released patch, which seems ineffective to correct the issue, this advisory is replaced by OSVDB ID 31911.
Solution
Currently, there are no known workarounds or upgrades to correct this issue. However, Suse/Novell, Ubuntu, Debian, Gentoo, RedHat and Mandriva have released patches to address this vulnerability.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
