CVE-2008-1097

Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .pcx file that triggers incorrect memory allocation for the scanline array, leading to memory corruption.

Affected Software

Name	Vendor	Start Version	End Version
Graphicsmagick	Imagemagick	1.1.7 (including)	1.1.7 (including)
Graphicsmagick	Imagemagick	1.1.8 (including)	1.1.8 (including)
Graphicsmagick	Imagemagick	1.1.9 (including)	1.1.9 (including)
Graphicsmagick	Imagemagick	1.1.10 (including)	1.1.10 (including)
Graphicsmagick	Imagemagick	1.1.11 (including)	1.1.11 (including)
Graphicsmagick	Imagemagick	1.1.12 (including)	1.1.12 (including)
Imagemagick	Imagemagick	6.2.8.0 (including)	6.2.8.0 (including)
Imagemagick	Imagemagick	6.2.8.1 (including)	6.2.8.1 (including)
Imagemagick	Imagemagick	6.2.8.2 (including)	6.2.8.2 (including)
Imagemagick	Imagemagick	6.2.8.3 (including)	6.2.8.3 (including)
Red Hat Enterprise Linux 2.1	RedHat	ImageMagick-0:5.3.8-21	*
Red Hat Enterprise Linux 3	RedHat	ImageMagick-0:5.5.6-28	*
Red Hat Enterprise Linux 4	RedHat	ImageMagick-0:6.0.7.1-17.el4_6.1	*
Red Hat Enterprise Linux 5	RedHat	ImageMagick-0:6.2.8.0-4.el5_1.1	*
Graphicsmagick	Ubuntu	edgy	*
Imagemagick	Ubuntu	feisty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2008-1097
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References