Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Imagemagick | Imagemagick | * | 6.3.5-9 (excluding) |
| Red Hat Enterprise Linux 3 | RedHat | ImageMagick-0:5.5.6-28 | * |
| Red Hat Enterprise Linux 4 | RedHat | ImageMagick-0:6.0.7.1-17.el4_6.1 | * |
| Red Hat Enterprise Linux 5 | RedHat | ImageMagick-0:6.2.8.0-4.el5_1.1 | * |
| Graphicsmagick | Ubuntu | devel | * |
| Graphicsmagick | Ubuntu | edgy | * |
| Graphicsmagick | Ubuntu | feisty | * |
| Graphicsmagick | Ubuntu | gutsy | * |
| Graphicsmagick | Ubuntu | hardy | * |
| Graphicsmagick | Ubuntu | intrepid | * |
| Graphicsmagick | Ubuntu | upstream | * |
| Imagemagick | Ubuntu | dapper | * |
| Imagemagick | Ubuntu | devel | * |
| Imagemagick | Ubuntu | edgy | * |
| Imagemagick | Ubuntu | feisty | * |
| Imagemagick | Ubuntu | gutsy | * |
| Imagemagick | Ubuntu | hardy | * |
| Imagemagick | Ubuntu | intrepid | * |
| Imagemagick | Ubuntu | upstream | * |