Red Hat セキュリティアドバイザリ 2007:0015 から：

いくつかのセキュリティの問題を修正する更新済みの ImageMagick パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

ImageMagick は、複数の画像形式の読み書きを行うことのできる、X Window System 用の画像表示・操作ツールです。

ImageMagick が DCM、PALM、SGI グラフィックファイルをデコードする方法で、いくつかのセキュリティの欠陥が見つかりました。被害者を騙して特別に細工された画像ファイルを開かせることができた場合、攻撃者が被害者のマシンで任意のコードを実行する可能性がありました（CVE-2006-5456、CVE-2006-5868）。

ImageMagick で、ヒープオーバーフローの欠陥が見つかりました。被害者を騙して、特別に細工されたファイルを開かせることができた場合、攻撃者が被害者のマシンで任意のコードを実行する可能性がありました（CVE-2006-2440）。この問題は、Red Hat Enterprise Linux 4 で配布された ImageMagick だけに影響します。

ImageMagick のユーザーは、バックポートされたパッチが含まれるこれらの更新済みパッケージにアップグレードし、これらの問題を解決する必要があります。

來自 Red Hat 安全性公告 2007:0015：

現已提供更新版 ImageMagick 套件，其可更正數個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

ImageMagick 是適用於 X Windows System 的影像顯示和操控工具，可以讀取和寫入多種影像格式。

在 ImageMagick 解碼 DCM、PALM 和 SGI 圖形檔案的方式中發現數個安全性瑕疵。攻擊者若能誘騙受害者開啟特製的影像檔，便或許可在該受害者的機器上執行任意程式碼 (CVE-2006-5456、CVE-2006-5868)。

在 ImageMagick 中發現堆積溢位瑕疵。攻擊者若能誘騙受害者開啟特製的檔案，便或許可在該受害者的機器上執行任意程式碼 (CVE-2006-2440)。此問題只會影響隨 Red Hat Enterprise Linux 4 發佈的 ImageMagick 版本。

ImageMagick 的使用者應升級至這些更新版套件，其中包含可更正這些問題的反向移植修補程式。

来自 Red Hat 安全公告 2007:0015：

更新后的 ImageMagick 程序包修正了多个安全问题，现在可用。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

ImageMagick 是用于 X Window 系统的图像显示和操纵工具，可以读取和写入多种图像格式。

在 ImageMagick 解码 DCM、PALM 和 SGI 图形文件的方式中发现多个安全缺陷。如果攻击者能够诱骗受害者打开特别构建的图像文件，则可在受害者的计算机上执行任意代码（CVE-2006-5456、CVE-2006-5868）。

在 ImageMagick 中发现一个堆溢出缺陷。如果攻击者能够诱骗受害者打开特别构建的文件，则可在受害者的计算机上执行任意代码 (CVE-2006-2440)。此问题仅影响随 Red Hat Enterprise Linux 4 发行的 ImageMagick 版本。

ImageMagick 用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2007:0015 :

Updated ImageMagick packages that correct several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Several security flaws were discovered in the way ImageMagick decodes DCM, PALM, and SGI graphic files. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file (CVE-2006-5456, CVE-2006-5868).

A heap overflow flaw was found in ImageMagick. An attacker may be able to execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted file (CVE-2006-2440). This issue only affected the version of ImageMagick distributed with Red Hat Enterprise Linux 4.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches to correct these issues.

SecurityFocus reports about ImageMagick :

ImageMagick is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

Several remote vulnerabilities have been discovered in Imagemagick, a collection of image manipulation programs, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-0082     Daniel Kobras discovered that Imagemagick is vulnerable     to format string attacks in the filename parsing code.

  - CVE-2006-4144     Damian Put discovered that Imagemagick is vulnerable to     buffer overflows in the module for SGI images.

  - CVE-2006-5456     M Joonas Pihlaja discovered that Imagemagick is     vulnerable to buffer overflows in the module for DCM and     PALM images.

  - CVE-2006-5868     Daniel Kobras discovered that Imagemagick is vulnerable     to buffer overflows in the module for SGI images.

This update also addresses regressions in the XCF codec, which were introduced in the previous security update.

Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.

Updated packages have been patched to correct this issue.

Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. (CVE-2006-3743)

Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun bitmap images that trigger heap-based buffer overflows.
(CVE-2006-3744)

Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow. (CVE-2006-4144)

The updated packages have been patched to correct these issues.

Damian Put discovered a buffer overflow in imagemagick's SGI file format decoder. By tricking an user or automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
67439	Oracle Linux 3 / 4：ImageMagick（ELSA-2007-0015）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67439	Oracle Linux 3 / 4 : ImageMagick (ELSA-2007-0015)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67439	Oracle Linux 3 / 4：ImageMagick (ELSA-2007-0015)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24357	CentOS 3 / 4 : ImageMagick (CESA-2007:0015)	Nessus	CentOS Local Security Checks	2007/2/17	2021/1/4	high
67439	Oracle Linux 3 / 4 : ImageMagick (ELSA-2007-0015)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
23758	FreeBSD : ImageMagick -- SGI Image File heap overflow vulnerability (18e3a5be-81f9-11db-95a2-0012f06707f0)	Nessus	FreeBSD Local Security Checks	2006/12/4	2021/1/6	high
24363	RHEL 2.1 / 3 / 4 : ImageMagick (RHSA-2007:0015)	Nessus	Red Hat Local Security Checks	2007/2/17	2021/1/14	high
23662	Debian DSA-1213-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	2006/11/20	2021/1/4	high
24607	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:223)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	high
23899	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:155)	Nessus	Mandriva Local Security Checks	2006/12/16	2021/1/6	high
27916	Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerability (USN-337-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
27969	Ubuntu 5.10 / 6.06 LTS : imagemagick vulnerability (USN-386-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

high

high