Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Try our Premium Alert Service
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service

Category:   Application (Multimedia)  >   ImageMagick Vendors:
ImageMagick ReadSGIImage() Heap Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016699
SecurityTracker URL:
CVE Reference:   CVE-2006-4144   (Links to External Site)
Updated:  Aug 24 2006
Original Entry Date:  Aug 15 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.x up to and including 6.2.8
Description:   A vulnerability was reported in ImageMagick. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted SGI image file that, when loaded by the target user, will trigger a heap overflow in the ReadSGIImage() function and execute arbitrary code on the target user's system. The flaw resides in 'coders/sgi.c'.

Damian Put reported this vulnerability.

The original advisory is available at:

A demonstration exploit is available at:

Impact:   A remote user can create an image file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fixed version (6.2.9).
Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Aug 24 2006 (Red Hat Issues Fix) ImageMagick ReadSGIImage() Heap Overflow Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, and 4.

 Source Message Contents

Subject:  [Full-disclosure] [] ImageMagick ReadSGIImage() Heap Security Advisory #7

ImageMagick ReadSGIImage() Heap Overflow

Vendor: ImageMagick (
Affected version: 6.x up to and including 6.2.8
Vendor status: Fixed version released (6.2.9)

Author: Damian Put <>
Date: 14.08.2006

1. Background

ImageMagick is a free software suite to create, edit, and compose bitmap images.
 It can read, convert and write images in a large variety of formats.

2. Description

Remote exploitation of a heap overflow vulnerability could allow execution of
arbitrary code or couse denial of service.

A heap overflow exists in ReadSGIImage() function, that is used to
decode a SGI image file. The vulnerable code is:


static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
    iris_info.bytes_per_pixel=(unsigned char) ReadBlobByte(image);
    bytes_per_pixel=(size_t) iris_info.bytes_per_pixel;
    number_pixels=(MagickSizeType) iris_info.columns*iris_info.rows;
    iris_pixels=(unsigned char *)AcquireMagickMemory

We can manipalute iris_info.rows, iris_info.columns and bytes_per_pixel
value. Allocation of memory to "iris_pixels" is based on this values.
When rows*cols*bytes_per_pixe*4 overflow integer variable, we can alloc not
enough memory for next operations, and cause heap overflow.

3. PoC

Example crafted SGI file:

[pucik@overflow ImageMagick-6.2.8]$ display imheap.sgi
*** glibc detected *** free(): invalid next size (fast): 0x08055dd0 ***
Abort (core dumped) 
[pucik@overflow ImageMagick-6.2.8]$ 

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, LLC