CVE-2018-16640 (published 2018-09-06T22:29Z)

ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2018-07-07 07:27:47-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1201
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -4560,7 +4560,11 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
         chunk=(unsigned char *) AcquireQuantumMemory(length,sizeof(*chunk));
 
         if (chunk == (unsigned char *) NULL)
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          {
+            DestroyJNG(NULL,&color_image,&color_image_info,
+              &alpha_image,&alpha_image_info);
+            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          }
 
         for (i=0; i < (ssize_t) length; i++)
         {
@@ -4587,13 +4591,12 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
             jng_width=(png_uint_32)mng_get_long(p);
             jng_height=(png_uint_32)mng_get_long(&p[4]);
             if ((jng_width == 0) || (jng_height == 0))
-            {
-              DestroyJNG(chunk,&color_image,&color_image_info,
-                &alpha_image,&alpha_image_info);
-
-              ThrowReaderException(CorruptImageError,
-                "NegativeOrZeroImageSize");
-            }
+              {
+                DestroyJNG(chunk,&color_image,&color_image_info,
+                  &alpha_image,&alpha_image_info);
+                ThrowReaderException(CorruptImageError,
+                  "NegativeOrZeroImageSize");
+              }
             jng_color_type=p[8];
             jng_image_sample_depth=p[9];
             jng_image_compression_method=p[10];

programming_language: C
filename: configure
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-5.
+# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-6.
 #
 # Report bugs to <https://github.com/ImageMagick/ImageMagick/issues>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='ImageMagick'
 PACKAGE_TARNAME='ImageMagick'
-PACKAGE_VERSION='7.0.8-5'
-PACKAGE_STRING='ImageMagick 7.0.8-5'
+PACKAGE_VERSION='7.0.8-6'
+PACKAGE_STRING='ImageMagick 7.0.8-6'
 PACKAGE_BUGREPORT='https://github.com/ImageMagick/ImageMagick/issues'
 PACKAGE_URL='https://www.imagemagick.org'
 
@@ -1842,7 +1842,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ImageMagick 7.0.8-5 to adapt to many kinds of systems.
+\`configure' configures ImageMagick 7.0.8-6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1917,7 +1917,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ImageMagick 7.0.8-5:";;
+     short | recursive ) echo "Configuration of ImageMagick 7.0.8-6:";;
    esac
   cat <<\_ACEOF
 
@@ -2204,7 +2204,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ImageMagick configure 7.0.8-5
+ImageMagick configure 7.0.8-6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -3255,7 +3255,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ImageMagick $as_me 7.0.8-5, which was
+It was created by ImageMagick $as_me 7.0.8-6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4241,7 +4241,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='ImageMagick'
- VERSION='7.0.8-5'
+ VERSION='7.0.8-6'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -4551,11 +4551,11 @@ MAGICK_MINOR_VERSION=0
 
 MAGICK_MICRO_VERSION=8
 
-MAGICK_PATCHLEVEL_VERSION=5
+MAGICK_PATCHLEVEL_VERSION=6
 
-MAGICK_VERSION=7.0.8-5
+MAGICK_VERSION=7.0.8-6
 
-MAGICK_GIT_REVISION=14506:0e75f0a50:20180703
+MAGICK_GIT_REVISION=14516:c7537dd70:20180705
 
 
 # Substitute library versioning
@@ -37632,7 +37632,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ImageMagick $as_me 7.0.8-5, which was
+This file was extended by ImageMagick $as_me 7.0.8-6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -37699,7 +37699,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-ImageMagick config.status 7.0.8-5
+ImageMagick config.status 7.0.8-6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

programming_language: Shell