NVD Vulnerability Detail

CVE-2009-1882

Summary	Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow. NOTE: some of these details are obtained from third party information.
Publication Date	June 3, 2009, 12:30 a.m.
Registration Date	Jan. 29, 2021, 1:18 p.m.
Last Update	Oct. 11, 2018, 4:38 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick:6.5.2-8:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://imagemagick.org/script/changelog.php	CONFIRM
2	http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033766.html	FEDORA
3	http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033833.html	FEDORA
4	http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	SUSE
5	http://mirror1.smudge-it.co.uk/imagemagick/www/changelog.html	CONFIRM
6	http://osvdb.org/54729	OSVDB
7	http://secunia.com/advisories/35216	SECUNIA	Vendor Advisory
8	http://secunia.com/advisories/35382	SECUNIA
9	http://secunia.com/advisories/35685	SECUNIA
10	http://secunia.com/advisories/36260	SECUNIA
11	http://secunia.com/advisories/37959	SECUNIA
12	http://secunia.com/advisories/55721	SECUNIA
13	http://security.gentoo.org/glsa/glsa-201311-10.xml	GENTOO
14	http://wiki.rpath.com/Advisories:rPSA-2010-0074	CONFIRM
15	http://www.debian.org/security/2009/dsa-1858	DEBIAN
16	http://www.openwall.com/lists/oss-security/2009/06/08/1	MLIST
17	http://www.securityfocus.com/archive/1/514516/100/0/threaded	BUGTRAQ
18	http://www.securityfocus.com/bid/35111	BID
19	http://www.vupen.com/english/advisories/2009/1449	VUPEN
20	https://usn.ubuntu.com/784-1/	UBUNTU

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

JVN Vulnerability Information

ImageMagick および GraphicsMagick の XMakeImage 関数における整数オーバーフローの脆弱性

Title	ImageMagick および GraphicsMagick の XMakeImage 関数における整数オーバーフローの脆弱性
Summary	ImageMagick および GraphicsMagick の magick/xwindow.c 内にある XMakeImage 関数には、TIFF ファイルに関する処理に不備があるため、整数オーバーフローの脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された TIFF ファイルを介して、バッファオーバーフローを誘発され、サービス運用妨害（DoS）状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 2, 2009, midnight
Registration Date	Sept. 15, 2010, 5:17 p.m.
Last Update	Sept. 15, 2010, 5:17 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

ImageMagick

ImageMagick 6.5.2-8 未満

GraphicsMagick

GraphicsMagick 1.2.10 未満

GraphicsMagick 1.3.8 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-1882	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1882
National Vulnerability Database (NVD)
2	CVE-2009-1882	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1882

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
GraphicsMagick
1	1.2.10 (January 6, 2010)	http://www.graphicsmagick.org/1.2/www/NEWS.html
2	1.3.8 (January 21, 2010)	http://www.graphicsmagick.org/1.3/NEWS.html#january-21-2010
ImageMagick Change Log
3	6.5.2-8 ChangeLog	http://www.imagemagick.org/script/changelog.php
Red Hat Security Advisory
4	RHSA-2010:0652	https://rhn.redhat.com/errata/RHSA-2010-0652.html
5	RHSA-2010:0653	https://rhn.redhat.com/errata/RHSA-2010-0653.html

その他

No	Name	URL
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
1	54729	http://osvdb.org/54729
Secunia Advisory
2	SA35216	http://secunia.com/advisories/35216
3	SA38472	http://secunia.com/advisories/38472
SecurityFocus
4	35111	http://www.securityfocus.com/bid/35111
VUPEN Security
5	VUPEN/ADV-2009-1449	http://www.vupen.com/english/advisories/2009/1449
6	VUPEN/ADV-2010-0311	http://www.vupen.com/english/advisories/2010/0311

Change Log

No	Changed Details	Date of change
0	[2010年09月15日] 掲載	Feb. 17, 2018, 10:37 a.m.