new release of the image processing and transformation package
, which addresses 52 potential vulnerabilities identified during fuzz testing by the project .
Since February 2018, OSS-Fuzz has identified a total of 343 issues, of which 331 have already been resolved in GraphicsMagick (the remaining 12 are still within the 90-day deadline for fixes). Separately
, OSS-Fuzz is also used to test a related project , which currently has over 100 unresolved issues, information on which is already publicly available following the expiration of the fix period.
In addition to the potential issues identified by the OSS-Fuzz project, GraphicsMagick 1.3.32 also fixes 14 vulnerabilities that could lead to buffer overflow when processing specially crafted images in formats such as SVG, BMP, DIB, MIFF, MAT, MNG, TGA,
TIFF, WMF, and XWD. Among security-unrelated improvements, enhanced support for WebP and the ability to write images in Braille format for viewing by the visually impaired are highlighted.
It is also noted that GraphicsMagick 1.3.32 removes a feature that could potentially be used to facilitate data leakage. This issue pertains to the handling of the '@filename' notation for SVG and WMF formats, which allows displaying text over an image or including it in the metadata from the specified file. Potentially, if web applications do not properly validate input parameters, attackers could exploit this function to access the contents of files on the server, such as access keys and saved passwords. The issue is also present in ImageMagick.
Source: opennet.ru
