RedHat: Important: ImageMagick security update
Posted by Benjamin D. Thomas   
RedHat Linux Updated ImageMagick packages that fix a buffer overflow issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: ImageMagick security update
Advisory ID:       RHSA-2005:413-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2005-413.html
Issue date:        2005-05-25
Updated on:        2005-05-25
Product:           Red Hat Enterprise Linux
- ---------------------------------------------------------------------

1. Summary:

Updated ImageMagick packages that fix a buffer overflow issue are now
available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

ImageMagick(TM) is an image display and manipulation tool for the X Window
System which can read and write multiple image formats.

A heap based buffer overflow bug was found in the way ImageMagick parses
PNM files. An attacker could execute arbitrary code on a victim's machine
if they were able to trick the victim into opening a specially crafted PNM
file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1275 to this issue.

Users of ImageMagick should upgrade to these updated packages, which
contain a backported patch, and are not vulnerable to this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

155953 - ImageMagick PNM heap overflow


6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939  ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e  ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed  ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004  ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9  ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf  ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44  ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31  ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e  ImageMagick-perl-5.5.6-14.ia64.rpm

ppc:
61a882a1ddc43197c44d8d807cebf87e  ImageMagick-5.5.6-14.ppc.rpm
dde736a8747a93350ce8b9b353efc045  ImageMagick-5.5.6-14.ppc64.rpm
2d52336caaee183028cb16b20355e211  ImageMagick-c++-5.5.6-14.ppc.rpm
7338bc1e2d2643643a303d1bc281b2e5  ImageMagick-c++-5.5.6-14.ppc64.rpm
f1706007d999b409a388abe831654304  ImageMagick-c++-devel-5.5.6-14.ppc.rpm
03c49c0f386233a7bd3ca3246183b829  ImageMagick-devel-5.5.6-14.ppc.rpm
6f11c4e4e528afad0a31a520cb0f5c6e  ImageMagick-perl-5.5.6-14.ppc.rpm

s390:
8b249cd0988f22bad64ccc71547e4173  ImageMagick-5.5.6-14.s390.rpm
260dd0e80f5754210442a5a922a880dd  ImageMagick-c++-5.5.6-14.s390.rpm
e45c1f6c0efcc5f0496f5242b5a3ad7e  ImageMagick-c++-devel-5.5.6-14.s390.rpm
31d0312826495ad73bd9c18437460798  ImageMagick-devel-5.5.6-14.s390.rpm
9b1a819b54830642d5d782643119f440  ImageMagick-perl-5.5.6-14.s390.rpm

s390x:
8b249cd0988f22bad64ccc71547e4173  ImageMagick-5.5.6-14.s390.rpm
db045788fbb9b484851461dc669dc1c7  ImageMagick-5.5.6-14.s390x.rpm
260dd0e80f5754210442a5a922a880dd  ImageMagick-c++-5.5.6-14.s390.rpm
c4d3572cc9850c59c7628a6c90cf4b4f  ImageMagick-c++-5.5.6-14.s390x.rpm
f53ece28b83e8ffec6443e814ea3e60c  ImageMagick-c++-devel-5.5.6-14.s390x.rpm
85770ab54225df2d09fb59f09541ff98  ImageMagick-devel-5.5.6-14.s390x.rpm
b87f2ea0d97e4de04f2e6680474cecb8  ImageMagick-perl-5.5.6-14.s390x.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919  ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46  ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61  ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b  ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a  ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939  ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e  ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed  ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004  ImageMagick-perl-5.5.6-14.i386.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919  ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46  ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61  ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b  ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a  ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939  ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e  ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed  ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004  ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9  ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf  ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44  ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31  ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e  ImageMagick-perl-5.5.6-14.ia64.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919  ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46  ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61  ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b  ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a  ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939  ImageMagick-5.5.6-14.src.rpm

i386:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e  ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed  ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004  ImageMagick-perl-5.5.6-14.i386.rpm

ia64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9  ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf  ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44  ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31  ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e  ImageMagick-perl-5.5.6-14.ia64.rpm

x86_64:
cec301ae8b013d54d6446caef945fddb  ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919  ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2  ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46  ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61  ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b  ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a  ImageMagick-perl-5.5.6-14.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533  ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3  ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa  ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c  ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c  ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52  ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414  ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e  ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40  ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56  ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec  ImageMagick-perl-6.0.7.1-11.ia64.rpm

ppc:
69353fd54da027ea07f25980c3ce0d89  ImageMagick-6.0.7.1-11.ppc.rpm
c0ce1b96e65429e8a8c2d0bc18e096ad  ImageMagick-c++-6.0.7.1-11.ppc.rpm
e47a22ced559637dd65ae48d0ea4bd94  ImageMagick-c++-devel-6.0.7.1-11.ppc.rpm
9bb71a4406621cade0cb8170b5a9b671  ImageMagick-devel-6.0.7.1-11.ppc.rpm
c16ba0ddbc52bb5e79a7640e486704b9  ImageMagick-perl-6.0.7.1-11.ppc.rpm

s390:
c66d6d3557835a4f8759bcaaae283b61  ImageMagick-6.0.7.1-11.s390.rpm
fe50719d170010c9d389ce15d0a0e3fe  ImageMagick-c++-6.0.7.1-11.s390.rpm
89f4a1a0ad454633b41654a717655b07  ImageMagick-c++-devel-6.0.7.1-11.s390.rpm
088f61ea3fd8733c00844ec4660c3940  ImageMagick-devel-6.0.7.1-11.s390.rpm
fa51ebe0d878e5079fa76e786bddc9c6  ImageMagick-perl-6.0.7.1-11.s390.rpm

s390x:
cc0d06a7e8de3d95b37b000bc9cb15b2  ImageMagick-6.0.7.1-11.s390x.rpm
6f823f887bd8b673630b2519081d31a7  ImageMagick-c++-6.0.7.1-11.s390x.rpm
a20512111f65942066441db7a11597df  ImageMagick-c++-devel-6.0.7.1-11.s390x.rpm
1cc6804b0b87aabfc2c01366c015c496  ImageMagick-devel-6.0.7.1-11.s390x.rpm
30fcc8201ae8a66fd6a72ec4f37b2883  ImageMagick-perl-6.0.7.1-11.s390x.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8  ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6  ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181  ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623  ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f  ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533  ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3  ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa  ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c  ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c  ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52  ImageMagick-perl-6.0.7.1-11.i386.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8  ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6  ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181  ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623  ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f  ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533  ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3  ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa  ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c  ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c  ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52  ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414  ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e  ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40  ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56  ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec  ImageMagick-perl-6.0.7.1-11.ia64.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8  ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6  ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181  ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623  ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f  ImageMagick-perl-6.0.7.1-11.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.rpm
654598df8ce20d97758403a8b1c6f533  ImageMagick-6.0.7.1-11.src.rpm

i386:
e901b7ab437561e7da8a97bae82ec1d3  ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa  ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c  ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c  ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52  ImageMagick-perl-6.0.7.1-11.i386.rpm

ia64:
5101a577cf65831572388147bb300414  ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e  ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40  ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56  ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec  ImageMagick-perl-6.0.7.1-11.ia64.rpm

x86_64:
75e1b60756dd17941aaf9a82c3ec85e8  ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6  ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181  ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623  ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f  ImageMagick-perl-6.0.7.1-11.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://www.overflow.pl/adv/imheapoverflow.txt

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.