NVD Vulnerability Detail

CVE-2014-1947

Summary	Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
Publication Date	Feb. 18, 2020, 6:15 a.m.
Registration Date	Jan. 26, 2021, 3:07 p.m.
Last Update	Nov. 21, 2024, 11:05 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick::::::::			6.5.4

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::::

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2014/02/12/13	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2014/02/12/13	Mailing List Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2014/02/12/2	Mailing List Patch Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2014/02/12/2	Mailing List Patch Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2014/02/13/2	Mailing List Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2014/02/13/2	Mailing List Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2014/02/13/5	Mailing List Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2014/02/13/5	Mailing List Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2014/02/19/13	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2014/02/19/13	Mailing List Third Party Advisory
11	https://bugzilla.redhat.com/show_bug.cgi?id=1064098	Issue Tracking Third Party Advisory
12	https://bugzilla.redhat.com/show_bug.cgi?id=1064098	Issue Tracking Third Party Advisory
13	https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html	Third Party Advisory
14	https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

ImageMagick における境界外書き込みに関する脆弱性

Title	ImageMagick における境界外書き込みに関する脆弱性
Summary	ImageMagick には、境界外書き込みに関する脆弱性が存在します。本脆弱性は、CVE-2014-2030 とは異なる脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Feb. 12, 2014, midnight
Registration Date	March 4, 2020, 6:16 p.m.
Last Update	March 4, 2020, 6:16 p.m.

Affected System

ImageMagick

ImageMagick 6.5.4 およびそれ以前

SUSE

SUSE Linux Enterprise Desktop

SUSE Linux Enterprise Server

SUSE Linux Enterprise Software Development Kit

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-1947	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1947
National Vulnerability Database (NVD)
2	CVE-2014-1947	https://nvd.nist.gov/vuln/detail/CVE-2014-1947

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
GitHub
1	ImageMagick	https://github.com/ImageMagick/ImageMagick
SUSE Security Update
2	SUSE-SU-2014:0359-1	https://www.suse.com/support/update/announcement/2014/suse-su-20140359-1.html

その他

No	Name	URL
関連文書
1	information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability"	https://www.openwall.com/lists/oss-security/2014/02/12/2

Change Log

No	Changed Details	Date of change
1	[2020年03月04日] 掲載	March 4, 2020, 6:16 p.m.