blob: fc0ac731f1bac0251595bf3a890a0cc499336e2e [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200501-37">
<title>GraphicsMagick: PSD decoding heap overflow</title>
GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop
Document (PSD) files, which could lead to arbitrary code execution.
<product type="ebuild">GraphicsMagick</product>
<announced>January 26, 2005</announced>
<revised>January 26, 2005: 01</revised>
<package name="media-gfx/graphicsmagick" auto="yes" arch="*">
<unaffected range="ge">1.1.5</unaffected>
<vulnerable range="lt">1.1.5</vulnerable>
GraphicsMagick is a collection of tools to read, write and
manipulate images in many formats. GraphicsMagick is originally derived
from ImageMagick 5.5.2.
Andrei Nigmatulin discovered that handling a Photoshop Document
(PSD) file with more than 24 layers in ImageMagick could trigger a heap
overflow (GLSA 200501-26). GraphicsMagick is based on the same code and
therefore suffers from the same flaw.
<impact type="normal">
An attacker could potentially design a malicious PSD image file to
cause arbitrary code execution with the permissions of the user running
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=media-gfx/graphicsmagick-1.1.5&quot;</code>
<uri link="">CAN-2005-0005</uri>
<uri link="/security/en/glsa/glsa-200501-26.xml">GLSA 200501-26</uri>
<metadata tag="submitter" timestamp="Wed, 26 Jan 2005 12:20:54 +0000">
<metadata tag="bugReady" timestamp="Wed, 26 Jan 2005 12:21:35 +0000">