Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:3378-1 Final 1 1 2017-12-20T11:23:56Z current 2017-12-20T11:23:56Z 2017-12-20T11:23:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes the following issues: * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas could possibly disclose potentially sensitive memory [bsc#1059778] * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in coders/tiff.c [bsc#1050632] * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1058485] * CVE-2017-14341: Infinite loop in the ReadWPGImage function [bsc#1058637] * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1067181] * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in validation problems could lead to denial of service [bsc#1067184] * CVE-2017-14175: Lack of End of File check could lead to denial of service [bsc#1057719] * CVE-2017-13769: denial of service issue in function WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432] * CVE-2017-13134: a heap-based buffer over-read was found in thefunction SFWScan in coders/sfw.c, which allows attackers to cause adenial of service via a crafted file. [bsc#1055214] * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick allows remote attackers to cause a DoS [bsc#1049796] * CVE-2017-15930: Null Pointer dereference while transfering JPEG scanlines could lead to denial of service [bsc#1066003] * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c allows remote attackers to cause a denial of service [bsc#1054757] * CVE-2017-14531: memory exhaustion issue in ReadSUNImage incoders/sun.c. [bsc#1059666] * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service [bsc#1052553] * CVE-2017-12587: User controlable large loop in the ReadPWPImage in coders\pwp.c could lead to denial of service [bsc#1052450] * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer overflow that could lead to denial of service [bsc#1057729] * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check. [bnc#1048457] * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows remote attackers to cause DoS [bnc#1050116] * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer over-read in WritePSImage() in coders/ps.c [bnc#1050139] * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows to cause DoS [bnc#1051441] * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a ninteger signedness error leading to excessive memory consumption [bnc#1051847] * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in coders/cals.c [bnc#1052689] * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in WritePDFImage in coders/pdf.c [bnc#1052758] * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in codersdcm.c [bnc#1052764] * CVE-2017-14172: ImageMagick: Lack of end of file check in ReadPSImage() could lead to a denial of service [bnc#1057730] * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in coders/rle.c could lead to denial of service [bnc#1060577] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ImageMagick-13384,slessp4-ImageMagick-13384 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ Link for SUSE-SU-2017:3378-1 https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00081.html E-Mail link for SUSE-SU-2017:3378-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1048457 SUSE Bug 1048457 https://bugzilla.suse.com/1049796 SUSE Bug 1049796 https://bugzilla.suse.com/1050116 SUSE Bug 1050116 https://bugzilla.suse.com/1050139 SUSE Bug 1050139 https://bugzilla.suse.com/1050632 SUSE Bug 1050632 https://bugzilla.suse.com/1051441 SUSE Bug 1051441 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052450 SUSE Bug 1052450 https://bugzilla.suse.com/1052553 SUSE Bug 1052553 https://bugzilla.suse.com/1052689 SUSE Bug 1052689 https://bugzilla.suse.com/1052758 SUSE Bug 1052758 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 https://bugzilla.suse.com/1054757 SUSE Bug 1054757 https://bugzilla.suse.com/1055214 SUSE Bug 1055214 https://bugzilla.suse.com/1056432 SUSE Bug 1056432 https://bugzilla.suse.com/1057719 SUSE Bug 1057719 https://bugzilla.suse.com/1057729 SUSE Bug 1057729 https://bugzilla.suse.com/1057730 SUSE Bug 1057730 https://bugzilla.suse.com/1058485 SUSE Bug 1058485 https://bugzilla.suse.com/1058637 SUSE Bug 1058637 https://bugzilla.suse.com/1059666 SUSE Bug 1059666 https://bugzilla.suse.com/1059778 SUSE Bug 1059778 https://bugzilla.suse.com/1060577 SUSE Bug 1060577 https://bugzilla.suse.com/1066003 SUSE Bug 1066003 https://bugzilla.suse.com/1067181 SUSE Bug 1067181 https://bugzilla.suse.com/1067184 SUSE Bug 1067184 https://www.suse.com/security/cve/CVE-2017-11188/ SUSE CVE CVE-2017-11188 page https://www.suse.com/security/cve/CVE-2017-11478/ SUSE CVE CVE-2017-11478 page https://www.suse.com/security/cve/CVE-2017-11527/ SUSE CVE CVE-2017-11527 page https://www.suse.com/security/cve/CVE-2017-11535/ SUSE CVE CVE-2017-11535 page https://www.suse.com/security/cve/CVE-2017-11640/ SUSE CVE CVE-2017-11640 page https://www.suse.com/security/cve/CVE-2017-11752/ SUSE CVE CVE-2017-11752 page https://www.suse.com/security/cve/CVE-2017-12140/ SUSE CVE CVE-2017-12140 page https://www.suse.com/security/cve/CVE-2017-12435/ SUSE CVE CVE-2017-12435 page https://www.suse.com/security/cve/CVE-2017-12587/ SUSE CVE CVE-2017-12587 page https://www.suse.com/security/cve/CVE-2017-12644/ SUSE CVE CVE-2017-12644 page https://www.suse.com/security/cve/CVE-2017-12662/ SUSE CVE CVE-2017-12662 page https://www.suse.com/security/cve/CVE-2017-12669/ SUSE CVE CVE-2017-12669 page https://www.suse.com/security/cve/CVE-2017-12983/ SUSE CVE CVE-2017-12983 page https://www.suse.com/security/cve/CVE-2017-13134/ SUSE CVE CVE-2017-13134 page https://www.suse.com/security/cve/CVE-2017-13769/ SUSE CVE CVE-2017-13769 page https://www.suse.com/security/cve/CVE-2017-14172/ SUSE CVE CVE-2017-14172 page https://www.suse.com/security/cve/CVE-2017-14173/ SUSE CVE CVE-2017-14173 page https://www.suse.com/security/cve/CVE-2017-14175/ SUSE CVE CVE-2017-14175 page https://www.suse.com/security/cve/CVE-2017-14341/ SUSE CVE CVE-2017-14341 page https://www.suse.com/security/cve/CVE-2017-14342/ SUSE CVE CVE-2017-14342 page https://www.suse.com/security/cve/CVE-2017-14531/ SUSE CVE CVE-2017-14531 page https://www.suse.com/security/cve/CVE-2017-14607/ SUSE CVE CVE-2017-14607 page https://www.suse.com/security/cve/CVE-2017-14733/ SUSE CVE CVE-2017-14733 page https://www.suse.com/security/cve/CVE-2017-15930/ SUSE CVE CVE-2017-15930 page https://www.suse.com/security/cve/CVE-2017-16545/ SUSE CVE CVE-2017-16545 page https://www.suse.com/security/cve/CVE-2017-16546/ SUSE CVE CVE-2017-16546 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-6.4.3.6-7.78.14.1 ImageMagick-devel-6.4.3.6-7.78.14.1 libMagick++-devel-6.4.3.6-7.78.14.1 libMagick++1-6.4.3.6-7.78.14.1 libMagickWand1-6.4.3.6-7.78.14.1 libMagickWand1-32bit-6.4.3.6-7.78.14.1 perl-PerlMagick-6.4.3.6-7.78.14.1 libMagickCore1-6.4.3.6-7.78.14.1 libMagickCore1-32bit-6.4.3.6-7.78.14.1 libMagickCore1-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ImageMagick-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-devel-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++-devel-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++1-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-32bit-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-PerlMagick-6.4.3.6-7.78.14.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check. CVE-2017-11188 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11188.html CVE-2017-11188 https://bugzilla.suse.com/1048457 SUSE Bug 1048457 The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image. CVE-2017-11478 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11478.html CVE-2017-11478 https://bugzilla.suse.com/1049796 SUSE Bug 1049796 The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-11527 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11527.html CVE-2017-11527 https://bugzilla.suse.com/1047054 SUSE Bug 1047054 https://bugzilla.suse.com/1050116 SUSE Bug 1050116 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c. CVE-2017-11535 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11535.html CVE-2017-11535 https://bugzilla.suse.com/1050139 SUSE Bug 1050139 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c. CVE-2017-11640 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11640.html CVE-2017-11640 https://bugzilla.suse.com/1050632 SUSE Bug 1050632 The ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-11752 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-11752.html CVE-2017-11752 https://bugzilla.suse.com/1051441 SUSE Bug 1051441 The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file. CVE-2017-12140 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12140.html CVE-2017-12140 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service. CVE-2017-12435 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12435.html CVE-2017-12435 https://bugzilla.suse.com/1052553 SUSE Bug 1052553 https://bugzilla.suse.com/1057508 SUSE Bug 1057508 ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c. CVE-2017-12587 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12587.html CVE-2017-12587 https://bugzilla.suse.com/1052450 SUSE Bug 1052450 ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c. CVE-2017-12644 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12644.html CVE-2017-12644 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c. CVE-2017-12662 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12662.html CVE-2017-12662 https://bugzilla.suse.com/1052758 SUSE Bug 1052758 ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c. CVE-2017-12669 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12669.html CVE-2017-12669 https://bugzilla.suse.com/1052689 SUSE Bug 1052689 Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. CVE-2017-12983 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-12983.html CVE-2017-12983 https://bugzilla.suse.com/1054757 SUSE Bug 1054757 In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file. CVE-2017-13134 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-13134.html CVE-2017-13134 https://bugzilla.suse.com/1055214 SUSE Bug 1055214 The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file. CVE-2017-13769 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-13769.html CVE-2017-13769 https://bugzilla.suse.com/1056432 SUSE Bug 1056432 In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. CVE-2017-14172 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14172.html CVE-2017-14172 https://bugzilla.suse.com/1057730 SUSE Bug 1057730 In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value. CVE-2017-14173 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14173.html CVE-2017-14173 https://bugzilla.suse.com/1057729 SUSE Bug 1057729 In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop. CVE-2017-14175 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14175.html CVE-2017-14175 https://bugzilla.suse.com/1056426 SUSE Bug 1056426 https://bugzilla.suse.com/1056429 SUSE Bug 1056429 https://bugzilla.suse.com/1057719 SUSE Bug 1057719 ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file. CVE-2017-14341 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14341.html CVE-2017-14341 https://bugzilla.suse.com/1058637 SUSE Bug 1058637 ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file. CVE-2017-14342 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14342.html CVE-2017-14342 https://bugzilla.suse.com/1058485 SUSE Bug 1058485 ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. CVE-2017-14531 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14531.html CVE-2017-14531 https://bugzilla.suse.com/1057508 SUSE Bug 1057508 https://bugzilla.suse.com/1059666 SUSE Bug 1059666 In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash. CVE-2017-14607 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14607.html CVE-2017-14607 https://bugzilla.suse.com/1059778 SUSE Bug 1059778 ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2017-14733 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-14733.html CVE-2017-14733 https://bugzilla.suse.com/1060577 SUSE Bug 1060577 In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer. CVE-2017-15930 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-15930.html CVE-2017-15930 https://bugzilla.suse.com/1066003 SUSE Bug 1066003 The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image. CVE-2017-16545 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-16545.html CVE-2017-16545 https://bugzilla.suse.com/1067184 SUSE Bug 1067184 The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file. CVE-2017-16546 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.14.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/ https://www.suse.com/security/cve/CVE-2017-16546.html CVE-2017-16546 https://bugzilla.suse.com/1067181 SUSE Bug 1067181