In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "imagemagick-6.q16", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "imagemagick-common", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagick++-6-headers", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagick++-6.q16-5v5", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagick++-6.q16-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagick++-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-6-arch-config", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-6-headers", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-6.q16-2", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-6.q16-2-extra", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-6.q16-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickwand-6-headers", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickwand-6.q16-2", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickwand-6.q16-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" }, { "binary_name": "perlmagick", "binary_version": "8:6.8.9.9-7ubuntu5.16+esm2" } ] }
{ "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "imagemagick-6-common", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "imagemagick-6.q16", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "imagemagick-6.q16hdri", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "imagemagick-common", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libimage-magick-q16hdri-perl", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-6-headers", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-6.q16-7", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-6.q16-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-6.q16hdri-7", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-6.q16hdri-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagick++-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6-arch-config", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6-headers", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16-3", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16-3-extra", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16hdri-3", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16hdri-3-extra", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-6.q16hdri-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-6-headers", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-6.q16-3", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-6.q16-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-6.q16hdri-3", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-6.q16hdri-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" }, { "binary_name": "perlmagick", "binary_version": "8:6.9.7.4+dfsg-16ubuntu6.15+esm4" } ] }
{ "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "imagemagick-6-common", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "imagemagick-6.q16", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "imagemagick-6.q16hdri", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "imagemagick-common", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libimage-magick-q16hdri-perl", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-6-headers", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-6.q16-8", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-6.q16-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-6.q16hdri-8", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-6.q16hdri-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagick++-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6-arch-config", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6-headers", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16-6", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16-6-extra", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16hdri-6", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16hdri-6-extra", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-6.q16hdri-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-6-headers", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-6.q16-6", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-6.q16-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-6.q16hdri-6", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-6.q16hdri-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" }, { "binary_name": "perlmagick", "binary_version": "8:6.9.10.23+dfsg-2.1ubuntu11.11+esm2" } ] }
{ "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "imagemagick-6-common", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "imagemagick-6.q16", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "imagemagick-6.q16hdri", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "imagemagick-common", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libimage-magick-q16hdri-perl", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-6-headers", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-6.q16-8", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-6.q16-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-6.q16hdri-8", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-6.q16hdri-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagick++-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6-arch-config", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6-headers", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16-6", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16-6-extra", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16hdri-6", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16hdri-6-extra", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-6.q16hdri-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-6-headers", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-6.q16-6", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-6.q16-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-6.q16hdri-6", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-6.q16hdri-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" }, { "binary_name": "perlmagick", "binary_version": "8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5" } ] }
{ "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "imagemagick-6-common", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "imagemagick-6.q16", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "imagemagick-6.q16hdri", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libimage-magick-q16hdri-perl", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-6-headers", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-6.q16-9t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-6.q16-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-6.q16hdri-9t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-6.q16hdri-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagick++-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6-arch-config", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6-headers", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16-7-extra", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16-7t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16hdri-7-extra", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16hdri-7t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-6.q16hdri-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-6-headers", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-6.q16-7t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-6.q16-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-6.q16hdri-7t64", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-6.q16hdri-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" }, { "binary_name": "perlmagick", "binary_version": "8:6.9.12.98+dfsg1-5.2build2" } ] }
{ "binaries": [ { "binary_name": "imagemagick", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "imagemagick-7-common", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "imagemagick-7.q16", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "imagemagick-7.q16hdri", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libimage-magick-perl", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libimage-magick-q16-perl", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libimage-magick-q16hdri-perl", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-7-headers", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-7.q16-5", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-7.q16-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-7.q16hdri-5", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-7.q16hdri-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagick++-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7-arch-config", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7-headers", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16-10", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16-10-extra", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16hdri-10", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16hdri-10-extra", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-7.q16hdri-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickcore-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-7-headers", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-7.q16-10", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-7.q16-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-7.q16hdri-10", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-7.q16hdri-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "libmagickwand-dev", "binary_version": "8:7.1.1.43+dfsg1-1" }, { "binary_name": "perlmagick", "binary_version": "8:7.1.1.43+dfsg1-1" } ] }