Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0043-1 Final 1 1 2018-01-09T06:59:50Z current 2018-01-09T06:59:50Z 2018-01-09T06:59:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-14343: Fixed a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file (bsc#1058422). - CVE-2017-12691: The ReadOneLayer function in coders/xcf.c allowed remote attackers to cause a denial of service (memory consumption) via a crafted file (bsc#1058422). - CVE-2017-14042: Prevent memory allocation failure in the ReadPNMImage function in coders/pnm.c. The vulnerability caused a big memory allocation, which may have lead to remote denial of service in the MagickRealloc function in magick/memory.c (bsc#1056550). - CVE-2017-15281: ReadPSDImage in coders/psd.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file (bsc#1063049). - CVE-2017-13061: A length-validation vulnerability in the function ReadPSDLayersInternal in coders/psd.c allowed attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file (bsc#1055063). - CVE-2017-12563: A memory exhaustion vulnerability in the function ReadPSDImage in coders/psd.c allowed attackers to cause a denial of service (bsc#1052460). - CVE-2017-14174: coders/psd.c allowed for DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might have caused huge CPU consumption. When a crafted PSD file, which claims a large 'length' field in the header but did not contain sufficient backing data, is provided, the loop over 'length' would consume huge CPU resources, since there is no EOF check inside the loop (bsc#1057723). - CVE-2017-13062: A memory leak vulnerability in the function formatIPTC in coders/meta.c allowed attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file (bsc#1055053). - CVE-2017-15277: ReadGIFImage in coders/gif.c left the palette uninitialized when processing a GIF file that has neither a global nor local palette. If this functionality was used as a library loaded into a process that operates on interesting data, this data sometimes could have been leaked via the uninitialized palette (bsc#1063050). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ImageMagick-13399,slessp4-ImageMagick-13399 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ Link for SUSE-SU-2018:0043-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003578.html E-Mail link for SUSE-SU-2018:0043-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1052460 SUSE Bug 1052460 https://bugzilla.suse.com/1055053 SUSE Bug 1055053 https://bugzilla.suse.com/1055063 SUSE Bug 1055063 https://bugzilla.suse.com/1056550 SUSE Bug 1056550 https://bugzilla.suse.com/1057723 SUSE Bug 1057723 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1063049 SUSE Bug 1063049 https://bugzilla.suse.com/1063050 SUSE Bug 1063050 https://www.suse.com/security/cve/CVE-2017-12563/ SUSE CVE CVE-2017-12563 page https://www.suse.com/security/cve/CVE-2017-12691/ SUSE CVE CVE-2017-12691 page https://www.suse.com/security/cve/CVE-2017-13061/ SUSE CVE CVE-2017-13061 page https://www.suse.com/security/cve/CVE-2017-13062/ SUSE CVE CVE-2017-13062 page https://www.suse.com/security/cve/CVE-2017-14042/ SUSE CVE CVE-2017-14042 page https://www.suse.com/security/cve/CVE-2017-14174/ SUSE CVE CVE-2017-14174 page https://www.suse.com/security/cve/CVE-2017-14343/ SUSE CVE CVE-2017-14343 page https://www.suse.com/security/cve/CVE-2017-15277/ SUSE CVE CVE-2017-15277 page https://www.suse.com/security/cve/CVE-2017-15281/ SUSE CVE CVE-2017-15281 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-6.4.3.6-7.78.17.1 ImageMagick-devel-6.4.3.6-7.78.17.1 libMagick++-devel-6.4.3.6-7.78.17.1 libMagick++1-6.4.3.6-7.78.17.1 libMagickWand1-6.4.3.6-7.78.17.1 libMagickWand1-32bit-6.4.3.6-7.78.17.1 perl-PerlMagick-6.4.3.6-7.78.17.1 libMagickCore1-6.4.3.6-7.78.17.1 libMagickCore1-32bit-6.4.3.6-7.78.17.1 libMagickCore1-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ImageMagick-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-devel-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++-devel-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++1-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-32bit-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-PerlMagick-6.4.3.6-7.78.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service. CVE-2017-12563 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-12563.html CVE-2017-12563 https://bugzilla.suse.com/1052460 SUSE Bug 1052460 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-12691 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-12691.html CVE-2017-12691 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file. CVE-2017-13061 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-13061.html CVE-2017-13061 https://bugzilla.suse.com/1055063 SUSE Bug 1055063 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file. CVE-2017-13062 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-13062.html CVE-2017-13062 https://bugzilla.suse.com/1055053 SUSE Bug 1055053 https://bugzilla.suse.com/1055055 SUSE Bug 1055055 A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c. CVE-2017-14042 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-14042.html CVE-2017-14042 https://bugzilla.suse.com/1054598 SUSE Bug 1054598 https://bugzilla.suse.com/1054600 SUSE Bug 1054600 https://bugzilla.suse.com/1056550 SUSE Bug 1056550 https://bugzilla.suse.com/1059721 SUSE Bug 1059721 In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. CVE-2017-14174 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-14174.html CVE-2017-14174 https://bugzilla.suse.com/1057723 SUSE Bug 1057723 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file. CVE-2017-14343 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-14343.html CVE-2017-14343 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette. CVE-2017-15277 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-15277.html CVE-2017-15277 https://bugzilla.suse.com/1063050 SUSE Bug 1063050 ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)." CVE-2017-15281 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.17.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.17.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180043-1/ https://www.suse.com/security/cve/CVE-2017-15281.html CVE-2017-15281 https://bugzilla.suse.com/1063049 SUSE Bug 1063049 https://bugzilla.suse.com/1072901 SUSE Bug 1072901