ImageMagick: PSD decoding heap overflow — GLSA 200501-26

ImageMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.

Affected packages

Background

ImageMagick is a collection of tools to read, write and manipulate images in many formats.

Description

Andrei Nigmatulin discovered that a Photoshop Document (PSD) file with more than 24 layers could trigger a heap overflow.

Impact

An attacker could potentially design a mailicous PSD image file to cause arbitrary code execution with the permissions of the user running ImageMagick.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.1.8.8"

References

• CAN-2005-0005
• iDEFENSE Advisory

Release date
January 20, 2005

Latest revision
January 20, 2005: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 77932