Terry Chia

Name of the Vulnerable Software and Affected Versions: Apache ORC versions 1.0.0 through 1.4.3 Description: A malformed ORC file can cause an endlessly recursive function call in the C++ or Java parser, potentially leading to a denial-of-service against software that uses the ORC file parser. The C++ parser may also experience a stack overflow, which could corrupt the stack. Recommendations: For Apache ORC versions 1.0.0 through 1.4.3, consider updating to a version that fixes this issue to prevent denial-of-service attacks and potential stack corruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to a heap-based buffer overflow in the DescribeImage() function of the magick/describe.c file, specifically in the "Display visual image directory" feature. This can be triggered by running the identify command on a specially crafted MIFF format file with the verbose flag. Additionally, the vulnerability is caused by a buffer overflow in the ReadOneJNGImage function of the coders/png.c file, which can allow a remote attacker to execute arbitrary code. **Recommendations** For GraphicsMagick version 1.3.26, consider disabling the DescribeImage() function or restricting the use of the identify command with the verbose flag until a patch is available. As a temporary workaround, avoid using the ReadOneJNGImage function in the coders/png.c file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to a heap-based buffer over-read in the DescribeImage function of the magick/describe.c file, which can lead to a memory information disclosure. This can be triggered by a specially crafted MIFF file, causing an out-of-bounds buffer dereference due to un-checked increments. The vulnerable code portion is responsible for printing the IPTC Profile information contained in the image. **Recommendations** For GraphicsMagick version 1.3.26, as a temporary workaround, consider disabling the `DescribeImage` function until a patch is available. Restrict access to the `magick/describe.c` file to minimize the risk of exploitation. Avoid using specially crafted MIFF files with the affected `DescribeImage` function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Artifex MuPDF version 1.11 **Description** An integer overflow was discovered in the `pdf read new xref section` function in `pdf/pdf-xref.c`. This issue affects the processing of PDF files. **Recommendations** For Artifex MuPDF version 1.11, consider updating to a newer version that addresses the integer overflow issue in the `pdf read new xref section` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick version 1.3.26 **Description** The issue is related to the `ReadDCMImage` function in `coders/dcm.c`, which can cause a denial of service due to a NULL pointer dereference when processing a crafted DICOM image. This is connected to the `DCM ReadNonNativeImages` function's ability to return an image list with zero frames. The vulnerability can be exploited by remote attackers using a specially crafted DICOM file, leading to a service disruption. **Recommendations** For GraphicsMagick version 1.3.26, consider disabling the `ReadDCMImage` function in `coders/dcm.c` as a temporary workaround to prevent exploitation until a patch is available. Restrict the processing of DICOM images to minimize the risk of service disruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.