CVE-2014-2030

Un desbordamiento del búfer en la región stack de la memoria en la función WritePSDImage en el archivo coders/psd.c en ImageMagick, posiblemente versión 6.8.8-5, permite a atacantes remotos causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario por medio de una imagen PSD diseñada, que involucra la cadena L%06ld, una vulnerabilidad diferente de CVE-2014-1947.

Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that ImageMagick incorrectly handled certain restart markers in JPEG images. If a user or automated system using ImageMagick were tricked into opening a specially crafted JPEG image, an attacker could exploit this to cause memory consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. It was discovered that ImageMagick incorrectly handled decoding certain PSD images. If a user or automated system using ImageMagick were tricked into opening a specially crafted PSD image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Various other issues were also addressed.