ImageMagick PNM图像解码远程缓冲区溢出漏洞

ImageMagick是一套稳定的工具集和开发包，可以用来读、写和处理超过89种基本格式的图片文件，包括流行的TIFF， JPEG， GIF， PNG， PDF以及PhotoCD等格式。利用ImageMagick，你可以根据web应用程序的需要动态生成图片， 还可以对一个图片或图片序列进行改变大小、旋转、锐化、减色或增加特效，并将操作的结果以相同格式或其它格式保存。对图片的操作，可以通过命令行进行，也可以用C/C++、Perl、Java、PHP、Python或Ruby编程来完成。同时ImageMagick提供了一个高质量的2D工具包，部分地支持SVG。现在，ImageMagic的主要精力集中在性能、减少bug以及提供稳定的API和ABI上。
用于ImageMagick 6.2.1及更早版本的pnm.c中的ReadPNMImage函数存在栈缓冲区溢出，远程攻击者可以通过带有小颜色值的PNM文件来发起拒绝服务攻击(应用程序崩溃)。

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：
ImageMagick ImageMagick 5.5.7.15
Mandriva ImageMagick-5.5.7.15-6.4.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva ImageMagick-5.5.7.15-6.4.C30mdk.src.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-5.5.7.15-6.4.C30mdk.src.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva ImageMagick-5.5.7.15-6.4.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-5.5.7.15-6.4.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-5.5.7.15-6.4.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick5.5.7-5.5.7.15-6.4.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick5.5.7-devel-5.5.7.15-6.4.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
Mandriva libMagick5.5.7-5.5.7.15-6.4.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva libMagick5.5.7-devel-5.5.7.15-6.4.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva perl-Magick-5.5.7.15-6.4.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva perl-Magick-5.5.7.15-6.4.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download
RedHat Fedora Core2
Fedora ImageMagick-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core 2
http://download.fedoralegacy.org/fedora/2/updates/i386/ImageMagick-6.2 .0.7-2.fc2.4.legacy.i386.rpm
Fedora ImageMagick-c++-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core 2
http://download.fedoralegacy.org/fedora/2/updates/i386/ImageMagick-c++ -6.2.0.7-2.fc2.4.legacy.i386.rpm
Fedora ImageMagick-c++-devel-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core 2
http://download.fedoralegacy.org/fedora/2/updates/i386/ImageMagick-c++ -devel-6.2.0.7-2.fc2.4.legacy.i386.rpm
Fedora ImageMagick-devel-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core 2
http://download.fedoralegacy.org/fedora/2/updates/i386/ImageMagick-dev el-6.2.0.7-2.fc2.4.legacy.i386.rpm
Fedora ImageMagick-perl-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core 2
http://download.fedoralegacy.org/fedora/2/updates/i386/ImageMagick-per l-6.2.0.7-2.fc2.4.legacy.i386.rpm
RedHat Fedora Core1
Fedora ImageMagick-5.5.6-13.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/ImageMagick-5.5 .6-13.legacy.i386.rpm
Fedora ImageMagick-c++-5.5.6-13.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/ImageMagick-c++ -5.5.6-13.legacy.i386.rpm
Fedora ImageMagick-c++-devel-5.5.6-13.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/ImageMagick-c++ -devel-5.5.6-13.legacy.i386.rpm
Fedora ImageMagick-devel-5.5.6-13.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/ImageMagick-dev el-5.5.6-13.legacy.i386.rpm
Fedora ImageMagick-perl-5.5.6-13.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/ImageMagick-per l-5.5.6-13.legacy.i386.rpm
ImageMagick ImageMagick 6.2.0.3
Mandriva ImageMagick-6.2.0.3-8.1.102mdk.i586.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.2.0.3-8.1.102mdk.src.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.2.0.3-8.1.102mdk.src.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.2.0.3-8.1.102mdk.x86_64.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-6.2.0.3-8.1.102mdk.i586.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-6.2.0.3-8.1.102mdk.x86_64.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick8.0.2-6.2.0.3-8.1.102mdk.x86_64.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick8.0.2-devel-6.2.0.3-8.1.102mdk.x86_64.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
Mandriva libMagick8.0.2-6.2.0.3-8.1.102mdk.i586.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva libMagick8.0.2-devel-6.2.0.3-8.1.102mdk.i586.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva perl-Image-Magick-6.2.0.3-8.1.102mdk.i586.rpm
Mandrakelinux 10.2:
http://www.mandriva.com/en/download
Mandriva perl-Image-Magick-6.2.0.3-8.1.102mdk.x86_64.rpm
Mandrakelinux 10.2/X86_64:
http://www.mandriva.com/en/download
ImageMagick ImageMagick 6.0.4.4
Mandriva ImageMagick-6.0.4.4-5.3.101mdk.i586.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.0.4.4-5.3.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.0.4.4-5.3.101mdk.src.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva ImageMagick-6.0.4.4-5.3.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-6.0.4.4-5.3.101mdk.i586.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva ImageMagick-doc-6.0.4.4-5.3.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick6.4.0-6.0.4.4-5.3.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
Mandriva lib64Magick6.4.0-devel-6.0.4.4-5.3.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
Mandriva libMagick6.4.0-6.0.4.4-5.3.101mdk.i586.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva libMagick6.4.0-devel-6.0.4.4-5.3.101mdk.i586.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva perl-Magick-6.0.4.4-5.3.101mdk.i586.rpm
Mandrakelinux 10.1:
http://www.mandriva.com/en/download
Mandriva perl-Magick-6.0.4.4-5.3.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
GraphicsMagick GraphicsMagick 1.0
GraphicsMagick GraphicsMagick-1.1.6.tar.gz
http://prdownloads.sourceforge.net/graphicsmagick/GraphicsMagick-1.1.6 .tar.gz?download
GraphicsMagick GraphicsMagick 1.0.6
GraphicsMagick GraphicsMagick-1.1.6.tar.gz
http://prdownloads.sourceforge.net/graphicsmagick/GraphicsMagick-1.1.6 .tar.gz?download

来源: www.imagemagick.org
链接:http://www.imagemagick.org/script/changelog.php

来源: BID
名称: 13351
链接:http://www.securityfocus.com/bid/13351

来源: MISC
链接:http://www.overflow.pl/adv/imheapoverflow.txt

来源: BUGTRAQ
名称: 20050424 [Overflow.pl] ImageMagick ReadPNMImage() Heap Overflow
链接:http://seclists.org/lists/bugtraq/2005/Apr/0407.html

来源: MISC
链接:http://bugs.gentoo.org/show_bug.cgi?id=90423

来源: REDHAT
名称: RHSA-2005:413
链接:http://www.redhat.com/support/errata/RHSA-2005-413.html

来源: MANDRAKE
名称: MDKSA-2005:107
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2005:107

来源: US Government Resource: oval:org.mitre.oval:def:711
名称: oval:org.mitre.oval:def:711
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:711