【TWCERT/CC安全通報】TW-CA-2005-065-[RHSA-2005:413-01: Important
※ 本文轉錄自 [Lan] 信箱
作者: twcert@cert.org.tw (TWCERT/CC Fellows)
標題: 【TWCERT/CC安全通報】 TW-CA-2005-065-[RHSA-200
時間: Fri Jun 3 17:26:39 2005
-----BEGIN PGP SIGNED MESSAGE-----
TW-CA-2005-065-[RHSA-2005:413-01: Important: ImageMagick security update]
────────────────────────────────────────
TWCERT/CC發布日期：2005-06-03
原漏洞發布日期：2005-05-25
原漏洞最新更新日期：--
通用安全漏洞編號：
分類：Gain Privilege
來源參考：RHSA-2005:413-01
──── 簡述 ─────────────────────────────────
更新 ImageMagick 套件，修正一個緩衝區溢位問題。
──── 說明 ─────────────────────────────────
ImageMagick(TM) 是供 X Windows 系統使用的影像顯示與維護工具，可讀取多種影像格式。
ImageMagick 解析 PNM 檔案時存在一個堆疊緩衝區溢位弱點。當攻擊者成功地誘騙受害者
開啟一個精心設計的 PNM 檔案時，即可在受害電腦上執行任意程式碼。
CVE（cve.mitre.org）已將此問題命名為 CAN-2005-1275。
建議所有 ImageMagick 使用者更新此勘誤套件，內含弱點之修補檔案。
──── 影響平台 ───────────────────────────────
‧Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
‧Red Hat Desktop version 3 - i386, x86_64
‧Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
‧Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
‧Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
‧Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
‧Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
‧Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
──── 修正方式 ───────────────────────────────
在安裝更新之前，確定已安裝之前所有跟系統相關的錯誤修正。使用 Red Hat Network 來
下載及更新套件，輸入以下指令啟動 Red Hat Update Agent：
up2date
若要獲得更多手動安裝套件的資訊，請參閱下面網址，尋求適合您系統的指引手冊：
http://www.redhat.com/docs/manuals/enterprise/
Bug IDs fixed（詳見 http://bugzilla.redhat.com/）：
155953 - ImageMagick PNM 堆疊溢位
RPM 需求：
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
ppc:
61a882a1ddc43197c44d8d807cebf87e ImageMagick-5.5.6-14.ppc.rpm
dde736a8747a93350ce8b9b353efc045 ImageMagick-5.5.6-14.ppc64.rpm
2d52336caaee183028cb16b20355e211 ImageMagick-c++-5.5.6-14.ppc.rpm
7338bc1e2d2643643a303d1bc281b2e5 ImageMagick-c++-5.5.6-14.ppc64.rpm
f1706007d999b409a388abe831654304 ImageMagick-c++-devel-5.5.6-14.ppc.rpm
03c49c0f386233a7bd3ca3246183b829 ImageMagick-devel-5.5.6-14.ppc.rpm
6f11c4e4e528afad0a31a520cb0f5c6e ImageMagick-perl-5.5.6-14.ppc.rpm
s390:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
e45c1f6c0efcc5f0496f5242b5a3ad7e ImageMagick-c++-devel-5.5.6-14.s390.rpm
31d0312826495ad73bd9c18437460798 ImageMagick-devel-5.5.6-14.s390.rpm
9b1a819b54830642d5d782643119f440 ImageMagick-perl-5.5.6-14.s390.rpm
s390x:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
db045788fbb9b484851461dc669dc1c7 ImageMagick-5.5.6-14.s390x.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
c4d3572cc9850c59c7628a6c90cf4b4f ImageMagick-c++-5.5.6-14.s390x.rpm
f53ece28b83e8ffec6443e814ea3e60c ImageMagick-c++-devel-5.5.6-14.s390x.rpm
85770ab54225df2d09fb59f09541ff98 ImageMagick-devel-5.5.6-14.s390x.rpm
b87f2ea0d97e4de04f2e6680474cecb8 ImageMagick-perl-5.5.6-14.s390x.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ImageMagick-5.5.6-14.sr
c.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
ppc:
69353fd54da027ea07f25980c3ce0d89 ImageMagick-6.0.7.1-11.ppc.rpm
c0ce1b96e65429e8a8c2d0bc18e096ad ImageMagick-c++-6.0.7.1-11.ppc.rpm
e47a22ced559637dd65ae48d0ea4bd94 ImageMagick-c++-devel-6.0.7.1-11.ppc.rpm
9bb71a4406621cade0cb8170b5a9b671 ImageMagick-devel-6.0.7.1-11.ppc.rpm
c16ba0ddbc52bb5e79a7640e486704b9 ImageMagick-perl-6.0.7.1-11.ppc.rpm
s390:
c66d6d3557835a4f8759bcaaae283b61 ImageMagick-6.0.7.1-11.s390.rpm
fe50719d170010c9d389ce15d0a0e3fe ImageMagick-c++-6.0.7.1-11.s390.rpm
89f4a1a0ad454633b41654a717655b07 ImageMagick-c++-devel-6.0.7.1-11.s390.rpm
088f61ea3fd8733c00844ec4660c3940 ImageMagick-devel-6.0.7.1-11.s390.rpm
fa51ebe0d878e5079fa76e786bddc9c6 ImageMagick-perl-6.0.7.1-11.s390.rpm
s390x:
cc0d06a7e8de3d95b37b000bc9cb15b2 ImageMagick-6.0.7.1-11.s390x.rpm
6f823f887bd8b673630b2519081d31a7 ImageMagick-c++-6.0.7.1-11.s390x.rpm
a20512111f65942066441db7a11597df ImageMagick-c++-devel-6.0.7.1-11.s390x.rpm
1cc6804b0b87aabfc2c01366c015c496 ImageMagick-devel-6.0.7.1-11.s390x.rpm
30fcc8201ae8a66fd6a72ec4f37b2883 ImageMagick-perl-6.0.7.1-11.s390x.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ImageMagick-6.0.7.1-11.
src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
這些套件基於安全理由，均由 Red Hat 公司使用 GPG 簽章，可至下列網址取得 key：
https://www.redhat.com/security/team/key.html#package
──── 影響結果 ───────────────────────────────
──── 聯絡TWCERT/CC ─────────────────────────────
Tel: 886-7-5250211 FAX: 886-7-5250212
886-2-23563303 886-2-23924082
Email: twcert@cert.org.tw
URL: http://www.cert.org.tw/
PGP key: http://www.cert.org.tw/eng/pgp.htm
────────────────────────────────────────
附件：[Important: ImageMagick security update]
──── 原文 ─────────────────────────────────
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: ImageMagick security update
Advisory ID: RHSA-2005:413-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-413.html
Issue date: 2005-05-25
Updated on: 2005-05-25
Product: Red Hat Enterprise Linux
- - ---------------------------------------------------------------------
1. Summary:
Updated ImageMagick packages that fix a buffer overflow issue are now
available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
ImageMagick(TM) is an image display and manipulation tool for the X Window
System which can read and write multiple image formats.
A heap based buffer overflow bug was found in the way ImageMagick parses
PNM files. An attacker could execute arbitrary code on a victims machine
if they were able to trick the victim into opening a specially crafted PNM
file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1275 to this issue.
Users of ImageMagick should upgrade to these updated packages, which
contain a backported patch, and are not vulnerable to this issue.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
155953 - ImageMagick PNM heap overflow
6. RPMs required:
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
ppc:
61a882a1ddc43197c44d8d807cebf87e ImageMagick-5.5.6-14.ppc.rpm
dde736a8747a93350ce8b9b353efc045 ImageMagick-5.5.6-14.ppc64.rpm
2d52336caaee183028cb16b20355e211 ImageMagick-c++-5.5.6-14.ppc.rpm
7338bc1e2d2643643a303d1bc281b2e5 ImageMagick-c++-5.5.6-14.ppc64.rpm
f1706007d999b409a388abe831654304 ImageMagick-c++-devel-5.5.6-14.ppc.rpm
03c49c0f386233a7bd3ca3246183b829 ImageMagick-devel-5.5.6-14.ppc.rpm
6f11c4e4e528afad0a31a520cb0f5c6e ImageMagick-perl-5.5.6-14.ppc.rpm
s390:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
e45c1f6c0efcc5f0496f5242b5a3ad7e ImageMagick-c++-devel-5.5.6-14.s390.rpm
31d0312826495ad73bd9c18437460798 ImageMagick-devel-5.5.6-14.s390.rpm
9b1a819b54830642d5d782643119f440 ImageMagick-perl-5.5.6-14.s390.rpm
s390x:
8b249cd0988f22bad64ccc71547e4173 ImageMagick-5.5.6-14.s390.rpm
db045788fbb9b484851461dc669dc1c7 ImageMagick-5.5.6-14.s390x.rpm
260dd0e80f5754210442a5a922a880dd ImageMagick-c++-5.5.6-14.s390.rpm
c4d3572cc9850c59c7628a6c90cf4b4f ImageMagick-c++-5.5.6-14.s390x.rpm
f53ece28b83e8ffec6443e814ea3e60c ImageMagick-c++-devel-5.5.6-14.s390x.rpm
85770ab54225df2d09fb59f09541ff98 ImageMagick-devel-5.5.6-14.s390x.rpm
b87f2ea0d97e4de04f2e6680474cecb8 ImageMagick-perl-5.5.6-14.s390x.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ImageMagick-5.5.6-14.sr
c.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ImageMagick-5.5.6-14.src.rpm
da0b49cdf98cb5e29f5173055160c939 ImageMagick-5.5.6-14.src.rpm
i386:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
8427543707cbdcc9cda8e57ef8bf812e ImageMagick-c++-devel-5.5.6-14.i386.rpm
070a9f37b3763ee49af8f376496143ed ImageMagick-devel-5.5.6-14.i386.rpm
a147f6b274f13330eaf4f1bdf369f004 ImageMagick-perl-5.5.6-14.i386.rpm
ia64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
04eaac66bf3627d48be55a4da85659b9 ImageMagick-5.5.6-14.ia64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
13cf4e0824d50af8b8c4ab33b1430fdf ImageMagick-c++-5.5.6-14.ia64.rpm
1b9d3c586a98a4e6a93877401a42dd44 ImageMagick-c++-devel-5.5.6-14.ia64.rpm
bcb5689b37f19468a5f2172bfc50cc31 ImageMagick-devel-5.5.6-14.ia64.rpm
311ffedc040b6c5482b7f6bb6cc63c9e ImageMagick-perl-5.5.6-14.ia64.rpm
x86_64:
cec301ae8b013d54d6446caef945fddb ImageMagick-5.5.6-14.i386.rpm
265bb9d8e2bbe6bfae7ba5283fa09919 ImageMagick-5.5.6-14.x86_64.rpm
c8a33dda1f2a235eb933e9f3c1883cc2 ImageMagick-c++-5.5.6-14.i386.rpm
769f3c85dce9f011b4f44d50cc559b46 ImageMagick-c++-5.5.6-14.x86_64.rpm
d967904cba9c7c4a904e56a4bd9c0b61 ImageMagick-c++-devel-5.5.6-14.x86_64.rpm
122c25aa446c3d832ef2bb00eb26987b ImageMagick-devel-5.5.6-14.x86_64.rpm
4fcaf8d863a871b13eaecffb5f21c88a ImageMagick-perl-5.5.6-14.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
ppc:
69353fd54da027ea07f25980c3ce0d89 ImageMagick-6.0.7.1-11.ppc.rpm
c0ce1b96e65429e8a8c2d0bc18e096ad ImageMagick-c++-6.0.7.1-11.ppc.rpm
e47a22ced559637dd65ae48d0ea4bd94 ImageMagick-c++-devel-6.0.7.1-11.ppc.rpm
9bb71a4406621cade0cb8170b5a9b671 ImageMagick-devel-6.0.7.1-11.ppc.rpm
c16ba0ddbc52bb5e79a7640e486704b9 ImageMagick-perl-6.0.7.1-11.ppc.rpm
s390:
c66d6d3557835a4f8759bcaaae283b61 ImageMagick-6.0.7.1-11.s390.rpm
fe50719d170010c9d389ce15d0a0e3fe ImageMagick-c++-6.0.7.1-11.s390.rpm
89f4a1a0ad454633b41654a717655b07 ImageMagick-c++-devel-6.0.7.1-11.s390.rpm
088f61ea3fd8733c00844ec4660c3940 ImageMagick-devel-6.0.7.1-11.s390.rpm
fa51ebe0d878e5079fa76e786bddc9c6 ImageMagick-perl-6.0.7.1-11.s390.rpm
s390x:
cc0d06a7e8de3d95b37b000bc9cb15b2 ImageMagick-6.0.7.1-11.s390x.rpm
6f823f887bd8b673630b2519081d31a7 ImageMagick-c++-6.0.7.1-11.s390x.rpm
a20512111f65942066441db7a11597df ImageMagick-c++-devel-6.0.7.1-11.s390x.rpm
1cc6804b0b87aabfc2c01366c015c496 ImageMagick-devel-6.0.7.1-11.s390x.rpm
30fcc8201ae8a66fd6a72ec4f37b2883 ImageMagick-perl-6.0.7.1-11.s390x.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ImageMagick-6.0.7.1-11.
src.rpm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ImageMagick-6.0.7.1-11.src.r
pm
654598df8ce20d97758403a8b1c6f533 ImageMagick-6.0.7.1-11.src.rpm
i386:
e901b7ab437561e7da8a97bae82ec1d3 ImageMagick-6.0.7.1-11.i386.rpm
e6203e5faa28c0b01b2c77fe020af7fa ImageMagick-c++-6.0.7.1-11.i386.rpm
01d202ef44b2437e5068ceedd6ddc57c ImageMagick-c++-devel-6.0.7.1-11.i386.rpm
d06927257fadba8bddcdbe529aa5fd4c ImageMagick-devel-6.0.7.1-11.i386.rpm
b727c595bdf5369f037e5310fbe32d52 ImageMagick-perl-6.0.7.1-11.i386.rpm
ia64:
5101a577cf65831572388147bb300414 ImageMagick-6.0.7.1-11.ia64.rpm
74021628bf35c269163f910011d6179e ImageMagick-c++-6.0.7.1-11.ia64.rpm
9915d9290c163be04823e33ce7657b40 ImageMagick-c++-devel-6.0.7.1-11.ia64.rpm
ea3311125b829a021bdbe1b905e15d56 ImageMagick-devel-6.0.7.1-11.ia64.rpm
ad10bac3b682af14db196c53f68681ec ImageMagick-perl-6.0.7.1-11.ia64.rpm
x86_64:
75e1b60756dd17941aaf9a82c3ec85e8 ImageMagick-6.0.7.1-11.x86_64.rpm
918ba19e29a73f71247486e85da5f4a6 ImageMagick-c++-6.0.7.1-11.x86_64.rpm
4e4fadbb45bb05886c6e1c07ae257181 ImageMagick-c++-devel-6.0.7.1-11.x86_64.rpm
6bc4e66b410483242dea505f74019623 ImageMagick-devel-6.0.7.1-11.x86_64.rpm
497384b120f49f464823cf252240674f ImageMagick-perl-6.0.7.1-11.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://www.overflow.pl/adv/imheapoverflow.txt
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
────────────────────────────────────────
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
iQEVAwUBQqAhkacyQYefg2/NAQFXSAf+OZUO+hlOoR3YAv3jSyatroS9ohCMXVUy
4TjyM8SEU99Uzi2M3O1dMHckHOrioWRYhvbDUlpsBBMMxEOqh7wH+pjymKfy+G9L
35lAKVzMX9vGXIA6mHsXBt14rZ0GqeK+Qj5j5qFHibLsDpgslJftYoc3RPVJ3Tka
s0kUZDS+JavQLRk7+IcSgbUjw0xQzwUB9beDr0FE8/I+SLfQg0sljZK3hc+o5VMT
C6iRgqbu4+UWewMFte4EC86XpgZ2rBZRId0LxFuG3PEOMIAK/c4fNgW+6yncrii0
snSk9C0DJgJaFi51eJ0HaSXHCKUFIaEms0jMsSRMx0OEf/WqoO0mYA==
=csBM
-----END PGP SIGNATURE-----
--
Taiwan Computer Emergency Response Team Security Advisory mailing list.
Mail to : Majordomo@cert.org.tw and include a line "subscribe advisory".
Please visit http://www.cert.org.tw/.
PGP key : http://www.cert.org.tw/eng/pgp.htm
NetSecurity 近期熱門文章
PTT數位生活區 即時熱門文章
