On Fri, 1 Jan 2010 14:19:50 -0500 Michael Gilbert wrote: > On Fri, 1 Jan 2010 13:42:19 +0100 Bastien ROUCARIES wrote: > > > About CVE-2008-3134 (bcc Petr because it seems to be in charge of > > imagemagick > > at suse) > > > > >We had reviewed CVE-2008-3134 when it was first released and determined > > >that > > >the ImageMagick releases at that time did not suffer from the > > >vulnerabilities. > > >Its possible that older versions of ImageMagick (circa 2002) might have > > >the > > >vulnerabilities. DOS vulnerabilities are addressed with the -limit option. > > >Its perfectly valid, for example, to convert a 200000x200000 pixel image > > >but > > >it may be disruptive to a multi-user system. A solution may be to set the > > >disk limit to say 1GB so that any image that exceeds the limit causes > > >ImageMagick to exit. You can set a system wide policy in recent releases > > >of > > >ImageMagick. Just edit policy.xml > > > > URL: > > http://support.novell.com/security/cve/CVE-2008-3134.html > > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3134 > > > > We will therefore close thiis bug report, if nobody disagree. > > i don't think that this has been addressed yet. if you compare the > redhat graphicsmagick patch [0] to the unstable imagemagick source, you > will see that the additional limits to prevent these dos' are not > included. for example, looking at coders/avs.c you can see that the new > image size limits (AVS_WIDTH_LIMIT and AVS_HEIGHT_LIMIT) are not > applied. the same can probably be found for the other affected files, > but i have not checked. > > mike
[0] https://bugzilla.redhat.com/attachment.cgi?id=311575 -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
