NVD Vulnerability Detail

CVE-2014-2030

Summary	Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.
Publication Date	Feb. 7, 2020, 12:15 a.m.
Registration Date	Jan. 26, 2021, 3:07 p.m.
Last Update	Nov. 21, 2024, 11:05 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick:6.8.8-5:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html	Mailing List Third Party Advisory
5	http://ubuntu.com/usn/usn-2132-1	Third Party Advisory
6	http://ubuntu.com/usn/usn-2132-1	Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2014/02/12/2	Mailing List Patch Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2014/02/12/2	Mailing List Patch Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2014/02/13/5	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2014/02/13/5	Mailing List Third Party Advisory
11	http://www.openwall.com/lists/oss-security/2014/02/19/13	Mailing List Third Party Advisory
12	http://www.openwall.com/lists/oss-security/2014/02/19/13	Mailing List Third Party Advisory
13	https://bugzilla.redhat.com/show_bug.cgi?id=1064098	Issue Tracking Patch Third Party Advisory
14	https://bugzilla.redhat.com/show_bug.cgi?id=1064098	Issue Tracking Patch Third Party Advisory
15	https://web.archive.org/web/20090120112751/http://trac.imagemagick.org/changeset/13736	Patch Third Party Advisory
16	https://web.archive.org/web/20090120112751/http://trac.imagemagick.org/changeset/13736	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

ImageMagick における境界外書き込みに関する脆弱性

Title	ImageMagick における境界外書き込みに関する脆弱性
Summary	ImageMagick には、境界外書き込みに関する脆弱性が存在します。本脆弱性は、CVE-2014-1947 とは異なる脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 12, 2014, midnight
Registration Date	Feb. 25, 2020, 5:16 p.m.
Last Update	Feb. 25, 2020, 5:16 p.m.

Affected System

ImageMagick

ImageMagick 6.8.8-5

Canonical

Ubuntu

openSUSE project

openSUSE

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-2030	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2030
National Vulnerability Database (NVD)
2	CVE-2014-2030	https://nvd.nist.gov/vuln/detail/CVE-2014-2030

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
GitHub
1	ImageMagick	https://github.com/ImageMagick/ImageMagick
openSUSE Security Update
2	openSUSE-SU-2014:0362-1	http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html
3	openSUSE-SU-2014:0369-1	http://lists.opensuse.org/opensuse-updates/2014-03/msg00039.html
Ubuntu Security Notice
4	USN-2132-1	http://ubuntu.com/usn/usn-2132-1

その他

No	Name	URL
関連文書
1	Bug 1064098 (CVE-2014-1947) - CVE-2014-1947 ImageMagick: PSD writing layer name buffer overflow ("L%02ld")	https://bugzilla.redhat.com/show_bug.cgi?id=1064098
2	Changeset 13736	https://web.archive.org/web/20090120112751/http://trac.imagemagick.org/changeset/13736
3	information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability"	https://www.openwall.com/lists/oss-security/2014/02/12/2

Change Log

No	Changed Details	Date of change
1	[2020年02月25日] 掲載	Feb. 25, 2020, 5:16 p.m.