Ubuntu 12.04 LTS USN-1435-1 Moderate: ImageMagick Code Execution Risk

ubuntu

May 1, 2012

ImageMagick could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

ImageMagick could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- imagemagick: Image manipulation programs and library

Details:

Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick

incorrectly handled certain ResolutionUnit tags. If a user or automated

system using ImageMagick were tricked into opening a specially crafted

image, an attacker could exploit this to cause a denial of service or

possibly execute code with the privileges of the user invoking the program.

(CVE-2012-0247, CVE-2012-1185)

Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick

incorrectly handled certain IFD structures. If a user or automated

system using ImageMagick were tricked into opening a specially crafted

image, an attacker could exploit this to cause a denial of service.

(CVE-2012-0248, CVE-2012-1186)

Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that

ImageMagick...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution update instructions image manipulation ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  imagemagick                     8:6.6.9.7-5ubuntu3.1
  libmagick++4                    8:6.6.9.7-5ubuntu3.1

Ubuntu 11.10:
  imagemagick                     8:6.6.0.4-3ubuntu1.1
  libmagick++3                    8:6.6.0.4-3ubuntu1.1

Ubuntu 11.04:
  imagemagick                     7:6.6.2.6-1ubuntu4.1
  libmagick++3                    7:6.6.2.6-1ubuntu4.1

Ubuntu 10.04 LTS:
  imagemagick                     7:6.5.7.8-1ubuntu1.2
  libmagick++2                    7:6.5.7.8-1ubuntu1.2

In general, a standard system update will make all the necessary changes.