Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2724-1 Final 1 1 2016-11-04T10:18:42Z current 2016-11-04T10:18:42Z 2016-11-04T10:18:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes the following issues: These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact. - CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123) - CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127) - CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125) - CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629) - CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422) - CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711) - CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707) - CVE-2016-7531: Pbd file out of bound access (bsc#1000704) - CVE-2016-7529: Out-of-bound in quantum handling (bsc#1000399) - CVE-2016-7528: Out-of-bound access in xcf file coder (bsc#1000434) - CVE-2016-7527: Out-of-bound access in wpg file coder: (bsc#1000436) - CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700) - CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698) - CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695) - CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693) - CVE-2016-7516: Out-of-bounds problem in rle, pict, viff and sun files (bsc#1000692) - CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689) - CVE-2016-7446 CVE-2016-7447 CVE-2016-7448 CVE-2016-7449: various issues fixed in 1.3.25 (bsc#999673) - CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221) - CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066) - CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691) - CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690) - Divide by zero in WriteTIFFImage (bsc#1002206) - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-12835,slestso13-GraphicsMagick-12835 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ Link for SUSE-SU-2016:2724-1 https://lists.suse.com/pipermail/sle-security-updates/2016-November/002393.html E-Mail link for SUSE-SU-2016:2724-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000399 SUSE Bug 1000399 https://bugzilla.suse.com/1000434 SUSE Bug 1000434 https://bugzilla.suse.com/1000436 SUSE Bug 1000436 https://bugzilla.suse.com/1000689 SUSE Bug 1000689 https://bugzilla.suse.com/1000690 SUSE Bug 1000690 https://bugzilla.suse.com/1000691 SUSE Bug 1000691 https://bugzilla.suse.com/1000692 SUSE Bug 1000692 https://bugzilla.suse.com/1000693 SUSE Bug 1000693 https://bugzilla.suse.com/1000695 SUSE Bug 1000695 https://bugzilla.suse.com/1000698 SUSE Bug 1000698 https://bugzilla.suse.com/1000700 SUSE Bug 1000700 https://bugzilla.suse.com/1000704 SUSE Bug 1000704 https://bugzilla.suse.com/1000707 SUSE Bug 1000707 https://bugzilla.suse.com/1000711 SUSE Bug 1000711 https://bugzilla.suse.com/1001066 SUSE Bug 1001066 https://bugzilla.suse.com/1001221 SUSE Bug 1001221 https://bugzilla.suse.com/1002206 SUSE Bug 1002206 https://bugzilla.suse.com/1002209 SUSE Bug 1002209 https://bugzilla.suse.com/1002422 SUSE Bug 1002422 https://bugzilla.suse.com/1003629 SUSE Bug 1003629 https://bugzilla.suse.com/1005123 SUSE Bug 1005123 https://bugzilla.suse.com/1005125 SUSE Bug 1005125 https://bugzilla.suse.com/1005127 SUSE Bug 1005127 https://bugzilla.suse.com/999673 SUSE Bug 999673 https://www.suse.com/security/cve/CVE-2015-8957/ SUSE CVE CVE-2015-8957 page https://www.suse.com/security/cve/CVE-2015-8958/ SUSE CVE CVE-2015-8958 page https://www.suse.com/security/cve/CVE-2016-6823/ SUSE CVE CVE-2016-6823 page https://www.suse.com/security/cve/CVE-2016-7101/ SUSE CVE CVE-2016-7101 page https://www.suse.com/security/cve/CVE-2016-7446/ SUSE CVE CVE-2016-7446 page https://www.suse.com/security/cve/CVE-2016-7447/ SUSE CVE CVE-2016-7447 page https://www.suse.com/security/cve/CVE-2016-7448/ SUSE CVE CVE-2016-7448 page https://www.suse.com/security/cve/CVE-2016-7449/ SUSE CVE CVE-2016-7449 page https://www.suse.com/security/cve/CVE-2016-7515/ SUSE CVE CVE-2016-7515 page https://www.suse.com/security/cve/CVE-2016-7516/ SUSE CVE CVE-2016-7516 page https://www.suse.com/security/cve/CVE-2016-7517/ SUSE CVE CVE-2016-7517 page https://www.suse.com/security/cve/CVE-2016-7519/ SUSE CVE CVE-2016-7519 page https://www.suse.com/security/cve/CVE-2016-7522/ SUSE CVE CVE-2016-7522 page https://www.suse.com/security/cve/CVE-2016-7524/ SUSE CVE CVE-2016-7524 page https://www.suse.com/security/cve/CVE-2016-7527/ SUSE CVE CVE-2016-7527 page https://www.suse.com/security/cve/CVE-2016-7528/ SUSE CVE CVE-2016-7528 page https://www.suse.com/security/cve/CVE-2016-7529/ SUSE CVE CVE-2016-7529 page https://www.suse.com/security/cve/CVE-2016-7531/ SUSE CVE CVE-2016-7531 page https://www.suse.com/security/cve/CVE-2016-7533/ SUSE CVE CVE-2016-7533 page https://www.suse.com/security/cve/CVE-2016-7537/ SUSE CVE CVE-2016-7537 page https://www.suse.com/security/cve/CVE-2016-7800/ SUSE CVE CVE-2016-7800 page https://www.suse.com/security/cve/CVE-2016-7996/ SUSE CVE CVE-2016-7996 page https://www.suse.com/security/cve/CVE-2016-7997/ SUSE CVE CVE-2016-7997 page https://www.suse.com/security/cve/CVE-2016-8682/ SUSE CVE CVE-2016-8682 page https://www.suse.com/security/cve/CVE-2016-8683/ SUSE CVE CVE-2016-8683 page https://www.suse.com/security/cve/CVE-2016-8684/ SUSE CVE CVE-2016-8684 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-4.46.1 libGraphicsMagick2-1.2.5-4.46.1 perl-GraphicsMagick-1.2.5-4.46.1 GraphicsMagick-1.2.5-4.46.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-4.46.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-4.46.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-4.46.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-4.46.1 as a component of SUSE Studio Onsite 1.3 Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file. CVE-2015-8957 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2015-8957.html CVE-2015-8957 https://bugzilla.suse.com/1000690 SUSE Bug 1000690 https://bugzilla.suse.com/1000691 SUSE Bug 1000691 coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file. CVE-2015-8958 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2015-8958.html CVE-2015-8958 https://bugzilla.suse.com/1000690 SUSE Bug 1000690 https://bugzilla.suse.com/1000691 SUSE Bug 1000691 https://bugzilla.suse.com/1000694 SUSE Bug 1000694 https://bugzilla.suse.com/1028079 SUSE Bug 1028079 Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write. CVE-2016-6823 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.8 AV:N/AC:M/Au:N/C:N/I:P/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-6823.html CVE-2016-6823 https://bugzilla.suse.com/1001066 SUSE Bug 1001066 https://bugzilla.suse.com/1002207 SUSE Bug 1002207 The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file. CVE-2016-7101 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7101.html CVE-2016-7101 https://bugzilla.suse.com/1001221 SUSE Bug 1001221 https://bugzilla.suse.com/1002207 SUSE Bug 1002207 Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317. CVE-2016-7446 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7446.html CVE-2016-7446 https://bugzilla.suse.com/999673 SUSE Bug 999673 Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors. CVE-2016-7447 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7447.html CVE-2016-7447 https://bugzilla.suse.com/999673 SUSE Bug 999673 The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size. CVE-2016-7448 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7448.html CVE-2016-7448 https://bugzilla.suse.com/999673 SUSE Bug 999673 The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a file containing an "unterminated" string. CVE-2016-7449 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7449.html CVE-2016-7449 https://bugzilla.suse.com/999673 SUSE Bug 999673 The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels. CVE-2016-7515 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7515.html CVE-2016-7515 https://bugzilla.suse.com/1000689 SUSE Bug 1000689 https://bugzilla.suse.com/1000695 SUSE Bug 1000695 The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file. CVE-2016-7516 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7516.html CVE-2016-7516 https://bugzilla.suse.com/1000692 SUSE Bug 1000692 https://bugzilla.suse.com/1000693 SUSE Bug 1000693 https://bugzilla.suse.com/1000695 SUSE Bug 1000695 The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file. CVE-2016-7517 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7517.html CVE-2016-7517 https://bugzilla.suse.com/1000693 SUSE Bug 1000693 The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. CVE-2016-7519 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7519.html CVE-2016-7519 https://bugzilla.suse.com/1000689 SUSE Bug 1000689 https://bugzilla.suse.com/1000695 SUSE Bug 1000695 The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. CVE-2016-7522 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7522.html CVE-2016-7522 https://bugzilla.suse.com/1000698 SUSE Bug 1000698 coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. CVE-2016-7524 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7524.html CVE-2016-7524 https://bugzilla.suse.com/1000700 SUSE Bug 1000700 https://bugzilla.suse.com/1002422 SUSE Bug 1002422 coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. CVE-2016-7527 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7527.html CVE-2016-7527 https://bugzilla.suse.com/1000436 SUSE Bug 1000436 https://bugzilla.suse.com/1000702 SUSE Bug 1000702 The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file. CVE-2016-7528 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7528.html CVE-2016-7528 https://bugzilla.suse.com/1000434 SUSE Bug 1000434 coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file. CVE-2016-7529 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 6.3 AV:N/AC:M/Au:S/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7529.html CVE-2016-7529 https://bugzilla.suse.com/1000399 SUSE Bug 1000399 https://bugzilla.suse.com/1000434 SUSE Bug 1000434 https://bugzilla.suse.com/1000703 SUSE Bug 1000703 https://bugzilla.suse.com/1054924 SUSE Bug 1054924 MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PDB file. CVE-2016-7531 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7531.html CVE-2016-7531 https://bugzilla.suse.com/1000704 SUSE Bug 1000704 The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file. CVE-2016-7533 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7533.html CVE-2016-7533 https://bugzilla.suse.com/1000707 SUSE Bug 1000707 MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file. CVE-2016-7537 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7537.html CVE-2016-7537 https://bugzilla.suse.com/1000711 SUSE Bug 1000711 Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow. CVE-2016-7800 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7800.html CVE-2016-7800 https://bugzilla.suse.com/1002422 SUSE Bug 1002422 Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries. CVE-2016-7996 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7996.html CVE-2016-7996 https://bugzilla.suse.com/1003629 SUSE Bug 1003629 https://bugzilla.suse.com/1067184 SUSE Bug 1067184 The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer. CVE-2016-7997 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-7997.html CVE-2016-7997 https://bugzilla.suse.com/1003629 SUSE Bug 1003629 The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header. CVE-2016-8682 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-8682.html CVE-2016-8682 https://bugzilla.suse.com/1005125 SUSE Bug 1005125 The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file." CVE-2016-8683 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-8683.html CVE-2016-8683 https://bugzilla.suse.com/1005127 SUSE Bug 1005127 The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file." CVE-2016-8684 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.46.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.46.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.46.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162724-1/ https://www.suse.com/security/cve/CVE-2016-8684.html CVE-2016-8684 https://bugzilla.suse.com/1005123 SUSE Bug 1005123