CVE-2023-3195 (published 2023-06-16T20:15Z)

A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2021-10-19 14:53:54-04:00
msg: fix stack overflow when parsing malicious tiff image
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,8 @@
     https://github.com/ImageMagick/ImageMagick/issues/4372).
   * fix possible unitialized values (reference
     https://github.com/ImageMagick/ImageMagick/issues/4379).
+  * fix stack overflow when parsing malicious tiff image file (report from
+    Muhammad Aldo Firmansyah).
 
 2021-10-10  7.1.0-10  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.1.0-10 GIT revision 19236:07ebe6b6e:20211010

programming_language: Markdown
filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -2001,6 +2001,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+#if defined(TIFF_VERSION_BIG)
+        extent+=image->columns*sizeof(uint64);
+#else
+        extent+=image->columns*sizeof(uint32);
+#endif
         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*tile_pixels));
         if (tile_pixels == (unsigned char *) NULL)

programming_language: C
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2021-10-19 14:53:41-04:00
msg: fix stack overflow when parsing malicious tiff image
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,8 @@
     https://github.com/ImageMagick/ImageMagick/issues/4372).
   * fix possible unitialized values (reference
     https://github.com/ImageMagick/ImageMagick/issues/4379).
+  * fix stack overflow when parsing malicious tiff image file (report from
+    Muhammad Aldo Firmansyah).
 
 2021-10-10  6.9.12-25  <quetzlzacatenango@image...>
   * Release ImageMagick version 6.9.12-25 GIT revision 16849:2c96ab5d0:20211010

programming_language: Markdown
filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -1892,6 +1892,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+#if defined(TIFF_VERSION_BIG)
+        extent+=image->columns*sizeof(uint64);
+#else
+        extent+=image->columns*sizeof(uint32);
+#endif
         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*tile_pixels));
         if (tile_pixels == (unsigned char *) NULL)

programming_language: C