GHSA-xg29-8ghv-v4xr
ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | Magick.NET-Q16-AnyCPU | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-AnyCPU | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-x86 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-OpenMP-x86 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-x86 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q16-HDRI-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-AnyCPU | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-OpenMP-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-OpenMP-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-arm64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-x64 | < 14.10.3 | 14.10.3 |
| NuGet | Magick.NET-Q8-x86 | < 14.10.3 | 14.10.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows.
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==143838==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000
#0 0x7f379d5adb53 (/lib/x86_64-linux-gnu/libc.so.6+0xc4b53)
```
References
External links from the advisory. They lead to third-party sites.