Issued:
2005-03-23
Updated:
2005-03-23

RHSA-2005:320 - Security Advisory

Synopsis

ImageMagick security update

Type/Severity

Security Advisory: Moderate

Topic

Updated ImageMagick packages that fix a format string bug are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

ImageMagick(TM) is an image display and manipulation tool for the X Window
System which can read and write multiple image formats.

A format string bug was found in the way ImageMagick handles filenames. An
attacker could execute arbitrary code on a victim's machine if they were
able to trick the victim into opening a file with a specially crafted name.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0397 to this issue.

Additionally, a bug was fixed which caused ImageMagick(TM) to occasionally
segfault when writing TIFF images to standard output.

Users of ImageMagick should upgrade to these updated packages, which
contain a backported patch, and are not vulnerable to these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

  • BZ - 142045 - Segmentation fault on conversion to TIFF (possible libtiff bug)
  • BZ - 150185 - CAN-2005-0397 ImageMagick format string flaw

CVEs

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
ImageMagick-6.0.7.1-10.src.rpm SHA-256: a46e7549d0b0026d7e1b77b22f5103e9df63472a1c50e84680e3b11ccd784500
x86_64
ImageMagick-6.0.7.1-10.x86_64.rpm SHA-256: 1d5c2cb521ec402c3c3015467f6367263497746907aadaa836b336e04163d03b
ImageMagick-6.0.7.1-10.x86_64.rpm SHA-256: 1d5c2cb521ec402c3c3015467f6367263497746907aadaa836b336e04163d03b
ImageMagick-c++-6.0.7.1-10.x86_64.rpm SHA-256: a86921ee81329bfdde6265324a53683a6047271e7dee337c7b4fce4181ba5bd0
ImageMagick-c++-6.0.7.1-10.x86_64.rpm SHA-256: a86921ee81329bfdde6265324a53683a6047271e7dee337c7b4fce4181ba5bd0
ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm SHA-256: ff5f120620e068e02afc0dfc0de4fc56f5155666e93251069f0cd92382aa68f1
ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm SHA-256: ff5f120620e068e02afc0dfc0de4fc56f5155666e93251069f0cd92382aa68f1
ImageMagick-devel-6.0.7.1-10.x86_64.rpm SHA-256: e0764cbbbd04db9bbbceb97c7c5aafe63f3f2c4d93ce3db4aa093bf5c25ae54b
ImageMagick-devel-6.0.7.1-10.x86_64.rpm SHA-256: e0764cbbbd04db9bbbceb97c7c5aafe63f3f2c4d93ce3db4aa093bf5c25ae54b
ImageMagick-perl-6.0.7.1-10.x86_64.rpm SHA-256: 90dd2e55edd4f8ac88b646a9fa09e160488a4aa18305dda256753cb0c7fe7565
ImageMagick-perl-6.0.7.1-10.x86_64.rpm SHA-256: 90dd2e55edd4f8ac88b646a9fa09e160488a4aa18305dda256753cb0c7fe7565
ia64
ImageMagick-6.0.7.1-10.ia64.rpm SHA-256: 92c5682b524e83b6a1b60a63c45940faa903beeff8fa7d9ec8dea5edc441cc67
ImageMagick-6.0.7.1-10.ia64.rpm SHA-256: 92c5682b524e83b6a1b60a63c45940faa903beeff8fa7d9ec8dea5edc441cc67
ImageMagick-c++-6.0.7.1-10.ia64.rpm SHA-256: 67d634927fee2611e4b2f4fd83921ffb1b40f35d17b68f786c506c537aa7d5ad
ImageMagick-c++-6.0.7.1-10.ia64.rpm SHA-256: 67d634927fee2611e4b2f4fd83921ffb1b40f35d17b68f786c506c537aa7d5ad
ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm SHA-256: 6a10236f7ae85732db3ff36672bd5606695baabd877ff4094318f1b5af841a27
ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm SHA-256: 6a10236f7ae85732db3ff36672bd5606695baabd877ff4094318f1b5af841a27
ImageMagick-devel-6.0.7.1-10.ia64.rpm SHA-256: e42f2e40ac2565222b5f9fbba025124e980143e3c4d12a35861e69c4510ac056
ImageMagick-devel-6.0.7.1-10.ia64.rpm SHA-256: e42f2e40ac2565222b5f9fbba025124e980143e3c4d12a35861e69c4510ac056
ImageMagick-perl-6.0.7.1-10.ia64.rpm SHA-256: 500435c1d042085542af3ab08c28f3afd81a8c97130b4ca859e985ef2dbf8ddb
ImageMagick-perl-6.0.7.1-10.ia64.rpm SHA-256: 500435c1d042085542af3ab08c28f3afd81a8c97130b4ca859e985ef2dbf8ddb
i386
ImageMagick-6.0.7.1-10.i386.rpm SHA-256: 4edd9dd7173a1f33d1166be1abf68a2f71ecc23e4c90c004d4b5c8d88f0d1e76
ImageMagick-6.0.7.1-10.i386.rpm SHA-256: 4edd9dd7173a1f33d1166be1abf68a2f71ecc23e4c90c004d4b5c8d88f0d1e76
ImageMagick-c++-6.0.7.1-10.i386.rpm SHA-256: 177071def3448c178fd406559454151c58417ce0e973606cd333a5610ea10aa6
ImageMagick-c++-6.0.7.1-10.i386.rpm SHA-256: 177071def3448c178fd406559454151c58417ce0e973606cd333a5610ea10aa6
ImageMagick-c++-devel-6.0.7.1-10.i386.rpm SHA-256: 52e3a4fdcb9002dffce799a13ffffe7e165e4abc39caf0427314987464a23f2e
ImageMagick-c++-devel-6.0.7.1-10.i386.rpm SHA-256: 52e3a4fdcb9002dffce799a13ffffe7e165e4abc39caf0427314987464a23f2e
ImageMagick-devel-6.0.7.1-10.i386.rpm SHA-256: 0e2cb5c66734793cdb092e38cd87a9c2503d55535377a1a83bf8530af88a7160
ImageMagick-devel-6.0.7.1-10.i386.rpm SHA-256: 0e2cb5c66734793cdb092e38cd87a9c2503d55535377a1a83bf8530af88a7160
ImageMagick-perl-6.0.7.1-10.i386.rpm SHA-256: d4fb2336c348a2ca3c59b9108474ccaf48176c4322d32678574718833b83c286
ImageMagick-perl-6.0.7.1-10.i386.rpm SHA-256: d4fb2336c348a2ca3c59b9108474ccaf48176c4322d32678574718833b83c286

Red Hat Enterprise Linux Workstation 4

SRPM
ImageMagick-6.0.7.1-10.src.rpm SHA-256: a46e7549d0b0026d7e1b77b22f5103e9df63472a1c50e84680e3b11ccd784500
x86_64
ImageMagick-6.0.7.1-10.x86_64.rpm SHA-256: 1d5c2cb521ec402c3c3015467f6367263497746907aadaa836b336e04163d03b
ImageMagick-c++-6.0.7.1-10.x86_64.rpm SHA-256: a86921ee81329bfdde6265324a53683a6047271e7dee337c7b4fce4181ba5bd0
ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm SHA-256: ff5f120620e068e02afc0dfc0de4fc56f5155666e93251069f0cd92382aa68f1
ImageMagick-devel-6.0.7.1-10.x86_64.rpm SHA-256: e0764cbbbd04db9bbbceb97c7c5aafe63f3f2c4d93ce3db4aa093bf5c25ae54b
ImageMagick-perl-6.0.7.1-10.x86_64.rpm SHA-256: 90dd2e55edd4f8ac88b646a9fa09e160488a4aa18305dda256753cb0c7fe7565
ia64
ImageMagick-6.0.7.1-10.ia64.rpm SHA-256: 92c5682b524e83b6a1b60a63c45940faa903beeff8fa7d9ec8dea5edc441cc67
ImageMagick-c++-6.0.7.1-10.ia64.rpm SHA-256: 67d634927fee2611e4b2f4fd83921ffb1b40f35d17b68f786c506c537aa7d5ad
ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm SHA-256: 6a10236f7ae85732db3ff36672bd5606695baabd877ff4094318f1b5af841a27
ImageMagick-devel-6.0.7.1-10.ia64.rpm SHA-256: e42f2e40ac2565222b5f9fbba025124e980143e3c4d12a35861e69c4510ac056
ImageMagick-perl-6.0.7.1-10.ia64.rpm SHA-256: 500435c1d042085542af3ab08c28f3afd81a8c97130b4ca859e985ef2dbf8ddb
i386
ImageMagick-6.0.7.1-10.i386.rpm SHA-256: 4edd9dd7173a1f33d1166be1abf68a2f71ecc23e4c90c004d4b5c8d88f0d1e76
ImageMagick-c++-6.0.7.1-10.i386.rpm SHA-256: 177071def3448c178fd406559454151c58417ce0e973606cd333a5610ea10aa6
ImageMagick-c++-devel-6.0.7.1-10.i386.rpm SHA-256: 52e3a4fdcb9002dffce799a13ffffe7e165e4abc39caf0427314987464a23f2e
ImageMagick-devel-6.0.7.1-10.i386.rpm SHA-256: 0e2cb5c66734793cdb092e38cd87a9c2503d55535377a1a83bf8530af88a7160
ImageMagick-perl-6.0.7.1-10.i386.rpm SHA-256: d4fb2336c348a2ca3c59b9108474ccaf48176c4322d32678574718833b83c286

Red Hat Enterprise Linux Desktop 4

SRPM
ImageMagick-6.0.7.1-10.src.rpm SHA-256: a46e7549d0b0026d7e1b77b22f5103e9df63472a1c50e84680e3b11ccd784500
x86_64
ImageMagick-6.0.7.1-10.x86_64.rpm SHA-256: 1d5c2cb521ec402c3c3015467f6367263497746907aadaa836b336e04163d03b
ImageMagick-c++-6.0.7.1-10.x86_64.rpm SHA-256: a86921ee81329bfdde6265324a53683a6047271e7dee337c7b4fce4181ba5bd0
ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm SHA-256: ff5f120620e068e02afc0dfc0de4fc56f5155666e93251069f0cd92382aa68f1
ImageMagick-devel-6.0.7.1-10.x86_64.rpm SHA-256: e0764cbbbd04db9bbbceb97c7c5aafe63f3f2c4d93ce3db4aa093bf5c25ae54b
ImageMagick-perl-6.0.7.1-10.x86_64.rpm SHA-256: 90dd2e55edd4f8ac88b646a9fa09e160488a4aa18305dda256753cb0c7fe7565
i386
ImageMagick-6.0.7.1-10.i386.rpm SHA-256: 4edd9dd7173a1f33d1166be1abf68a2f71ecc23e4c90c004d4b5c8d88f0d1e76
ImageMagick-c++-6.0.7.1-10.i386.rpm SHA-256: 177071def3448c178fd406559454151c58417ce0e973606cd333a5610ea10aa6
ImageMagick-c++-devel-6.0.7.1-10.i386.rpm SHA-256: 52e3a4fdcb9002dffce799a13ffffe7e165e4abc39caf0427314987464a23f2e
ImageMagick-devel-6.0.7.1-10.i386.rpm SHA-256: 0e2cb5c66734793cdb092e38cd87a9c2503d55535377a1a83bf8530af88a7160
ImageMagick-perl-6.0.7.1-10.i386.rpm SHA-256: d4fb2336c348a2ca3c59b9108474ccaf48176c4322d32678574718833b83c286

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
ImageMagick-6.0.7.1-10.src.rpm SHA-256: a46e7549d0b0026d7e1b77b22f5103e9df63472a1c50e84680e3b11ccd784500
s390x
ImageMagick-6.0.7.1-10.s390x.rpm SHA-256: 51446140a7d4777933e77105dba006b1f1c7e05931212864795403e642024781
ImageMagick-c++-6.0.7.1-10.s390x.rpm SHA-256: bb7f5cbc13ba1e15533ee3e81faa8c9bbf4620c019d8d7a700fc30b62a85a97b
ImageMagick-c++-devel-6.0.7.1-10.s390x.rpm SHA-256: 0a7e1fb2449132c9dc792a8b589ec9b185050afe82049c707e28c65c296460f4
ImageMagick-devel-6.0.7.1-10.s390x.rpm SHA-256: 0e5a14437fe0deb4e56d1cd649ec478abd4682cf8b7bdb7c5966b1f9da49dc58
ImageMagick-perl-6.0.7.1-10.s390x.rpm SHA-256: e2b0949e79bfd7966d92823867c50399ec2778766c97bbbe05710dc8b5dfdaeb
s390
ImageMagick-6.0.7.1-10.s390.rpm SHA-256: ac89c2500929bb78bcd34f2d4ad02ab90cd1ff2f3eb68d82ec268037f3771a4d
ImageMagick-c++-6.0.7.1-10.s390.rpm SHA-256: c0079ff5379d1179606d0636a56bdffaf1202bf6f6100517dcd6381855a530d4
ImageMagick-c++-devel-6.0.7.1-10.s390.rpm SHA-256: 422c98cd3b1b6ac90ae9ce00cec1b0900b1b1676795cd7b8d68642f691c63388
ImageMagick-devel-6.0.7.1-10.s390.rpm SHA-256: 5ecfad15336cd62d786956226b87d74fd1cdda637b9e21fe789d6b6cccd2af86
ImageMagick-perl-6.0.7.1-10.s390.rpm SHA-256: b378e832fafe60b66b1f0f69e446f07fbe5ef73e9c4c00aa0991cbe6d14056b4

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ImageMagick-6.0.7.1-10.src.rpm SHA-256: a46e7549d0b0026d7e1b77b22f5103e9df63472a1c50e84680e3b11ccd784500
ppc
ImageMagick-6.0.7.1-10.ppc.rpm SHA-256: 0cb3b31cdd4ecf4dbd21f3f1af557cef629935c31624b4174d694beda071e443
ImageMagick-c++-6.0.7.1-10.ppc.rpm SHA-256: 0a1c8e83583178c51ee131211b835ca50f1a52a590e52063eae78cce368a035c
ImageMagick-c++-devel-6.0.7.1-10.ppc.rpm SHA-256: 2433fb81872d0fc3fe831ee3845b3e187e5137499253c8ed4b557485bcb1f377
ImageMagick-devel-6.0.7.1-10.ppc.rpm SHA-256: 16b3365728528bb251b6c13b811b9bac10dadfe62283462fab67db7192b67027
ImageMagick-perl-6.0.7.1-10.ppc.rpm SHA-256: 788ae16710c94fb722e9db4ba3ce384859c078097aea49ffa14373cb9b3c984b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.