CVE-2019-17541 (published 2019-10-14T02:15Z)

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-07-18 06:24:40-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1641
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,16 +1,23 @@
+2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
+  * Release ImageMagick version 7.0.8-55, GIT revision 15...
+
+2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
+  * Heap-buffer overflow (reference
+    https://github.com/ImageMagick/ImageMagick/issues/1641
+
 2019-07-16  7.0.8-54 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-54, GIT revision 15916:e868e22:20190716.
 
 2019-07-08  7.0.8-54 Cristy  <quetzlzacatenango@image...>
-   * resolve division by zero  (reference
+  * resolve division by zero  (reference
      https://github.com/ImageMagick/ImageMagick/issues/1629).
-   * introducing MagickLevelImageColors() MagickWand method.
+  * introducing MagickLevelImageColors() MagickWand method.
   * Transient problem with text placement with gravity (reference
     https://github.com/ImageMagick/ImageMagick/issues/1633).
   * Support TIM2 image format (reference
     https://github.com/ImageMagick/ImageMagick/pull/1571).
   * For -magnify option, specify an alternative scaling method with -define
-	  magnify:method=method, choose from these methods: eagle2X, eagle3X,
+    magnify:method=method, choose from these methods: eagle2X, eagle3X,
     eagle3XB, epb2X, fish2X, hq2X,  scale2X (default), scale3X, xbr2X.
 
 2019-07-05  7.0.8-53 Cristy  <quetzlzacatenango@image...>
@@ -1488,7 +1495,7 @@
 2016-04-30  7.0.1-0 Cristy  <quetzlzacatenango@image...>
   * New version 7.0.1-0, GIT revision 10716:b527bce:20160430.
 
-2016-01-30  7.0.0-0 	Fahad-Alsaidi & ShamsaHamed
+2016-01-30  7.0.0-0 Fahad-Alsaidi & ShamsaHamed
   * Add support for languages that require complex text layout (reference
     https://github.com/ImageMagick/ImageMagick/pull/88).
 

programming_language: Markdown
filename: jpeg.c
change_type: ModificationType.MODIFY
diff: @@ -564,6 +564,7 @@ static boolean ReadICCProfile(j_decompress_ptr jpeg_info)
       break;
     *p++=(unsigned char) c;
   }
+  error_manager->profile=NULL;
   if (i != (ssize_t) length)
     {
       profile=DestroyStringInfo(profile);
@@ -572,7 +573,6 @@ static boolean ReadICCProfile(j_decompress_ptr jpeg_info)
         image->filename);
       return(FALSE);
     }
-  error_manager->profile=NULL;
   icc_profile=(StringInfo *) GetImageProfile(image,"icc");
   if (icc_profile != (StringInfo *) NULL)
     {
@@ -698,7 +698,9 @@ static boolean ReadIPTCProfile(j_decompress_ptr jpeg_info)
         image->filename);
       return(FALSE);
     }
-  /* The IPTC profile is actually an 8bim */
+  /*
+    The IPTC profile is actually an 8bim.
+  */
   iptc_profile=(StringInfo *) GetImageProfile(image,"8bim");
   if (iptc_profile != (StringInfo *) NULL)
     {

programming_language: Objective-C