CVE-2020-12672

Vulnerability

GraphicsMagick through version 1.3.35 includes a heap-based buffer overflow vulnerability in the ReadMNGImage function located in coders/png.c. This flaw can be exploited when processing a specially crafted MNG (Multiple-image Network Graphics) file, which may cause memory corruption. The vulnerability is present in all versions up to and including 1.3.35 [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious MNG file that is processed by GraphicsMagick tools or libraries. No special privileges are required; the attacker only needs to convince a user or application using GraphicsMagick to open the crafted file. The overflow occurs in the heap memory during the MNG decoding process, likely due to improper bounds checking [1].

Impact

Successful exploitation could lead to arbitrary code execution in the context of the GraphicsMagick process. The Gentoo security advisory characterizes it as a serious fuzzing issue that may allow for arbitrary code execution [1]. This could result in full compromise of the system if the process runs with high privileges, or at minimum cause a denial of service due to application crash.

Mitigation

The vulnerability is fixed in GraphicsMagick version 1.3.38, released on 2020-05-14. Users are strongly advised to upgrade to this version or later. Gentoo provides a GLSA (202209-19) with upgrade instructions for the media-gfx/graphicsmagick package. No known workaround exists for unpatched versions [1].