Security update for imlib2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1481-1 Final 1 1 2016-06-03T07:38:48Z current 2016-06-03T07:38:48Z 2016-06-03T07:38:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for imlib2 This update for imlib2 fixes the following issues: Security issues fixed: - CVE-2016-3994: Potential DOS in giflib loader (bsc#973759) - CVE-2016-3993: Off buy 1 in merge update (bsc#973761) - CVE-2014-9764: fix segmentation fault when opening specifically crafted input (bsc#963797) - CVE-2014-9763: Prevent division-by-zero crashes (bsc#963800) - CVE-2011-5326: Ellipse of width 1 triggers crashes (bsc#974202) Bugs fixed: - bsc#977538: Fix various potential crashes The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-imlib2-12595 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ Link for SUSE-SU-2016:1481-1 https://lists.suse.com/pipermail/sle-security-updates/2016-June/002091.html E-Mail link for SUSE-SU-2016:1481-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/963797 SUSE Bug 963797 https://bugzilla.suse.com/963800 SUSE Bug 963800 https://bugzilla.suse.com/973759 SUSE Bug 973759 https://bugzilla.suse.com/973761 SUSE Bug 973761 https://bugzilla.suse.com/974202 SUSE Bug 974202 https://bugzilla.suse.com/977538 SUSE Bug 977538 https://www.suse.com/security/cve/CVE-2011-5326/ SUSE CVE CVE-2011-5326 page https://www.suse.com/security/cve/CVE-2014-9763/ SUSE CVE CVE-2014-9763 page https://www.suse.com/security/cve/CVE-2014-9764/ SUSE CVE CVE-2014-9764 page https://www.suse.com/security/cve/CVE-2016-3993/ SUSE CVE CVE-2016-3993 page https://www.suse.com/security/cve/CVE-2016-3994/ SUSE CVE CVE-2016-3994 page SUSE Linux Enterprise Software Development Kit 11 SP4 imlib2-1.4.2-2.20.1 imlib2-devel-1.4.2-2.20.1 imlib2-filters-1.4.2-2.20.1 imlib2-loaders-1.4.2-2.20.1 imlib2-1.4.2-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 imlib2-devel-1.4.2-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 imlib2-filters-1.4.2-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 imlib2-loaders-1.4.2-2.20.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse. CVE-2011-5326 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-devel-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-filters-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-loaders-1.4.2-2.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ https://www.suse.com/security/cve/CVE-2011-5326.html CVE-2011-5326 https://bugzilla.suse.com/974202 SUSE Bug 974202 imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file. CVE-2014-9763 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-devel-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-filters-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-loaders-1.4.2-2.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ https://www.suse.com/security/cve/CVE-2014-9763.html CVE-2014-9763 https://bugzilla.suse.com/963796 SUSE Bug 963796 https://bugzilla.suse.com/963797 SUSE Bug 963797 https://bugzilla.suse.com/963800 SUSE Bug 963800 imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file. CVE-2014-9764 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-devel-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-filters-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-loaders-1.4.2-2.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ https://www.suse.com/security/cve/CVE-2014-9764.html CVE-2014-9764 https://bugzilla.suse.com/963796 SUSE Bug 963796 https://bugzilla.suse.com/963797 SUSE Bug 963797 https://bugzilla.suse.com/963800 SUSE Bug 963800 Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates. CVE-2016-3993 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-devel-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-filters-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-loaders-1.4.2-2.20.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ https://www.suse.com/security/cve/CVE-2016-3993.html CVE-2016-3993 https://bugzilla.suse.com/973761 SUSE Bug 973761 The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read. CVE-2016-3994 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-devel-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-filters-1.4.2-2.20.1 SUSE Linux Enterprise Software Development Kit 11 SP4:imlib2-loaders-1.4.2-2.20.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/ https://www.suse.com/security/cve/CVE-2016-3994.html CVE-2016-3994 https://bugzilla.suse.com/973759 SUSE Bug 973759 https://bugzilla.suse.com/974879 SUSE Bug 974879