Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0197-1 Final 1 1 2018-01-24T14:43:19Z current 2018-01-24T14:43:19Z 2018-01-24T14:43:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2017-14343: Fixed a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file (bsc#1058422) - CVE-2017-12691: The ReadOneLayer function in coders/xcf.c allowed remote attackers to cause a denial of service (memory consumption) via a crafted file (bsc#1058422) - CVE-2017-14042: Prevent memory allocation failure in the ReadPNMImage function in coders/pnm.c. The vulnerability caused a big memory allocation, which may have lead to remote denial of service in the MagickRealloc function in magick/memory.c (bsc#1056550) - CVE-2017-13061: A length-validation vulnerability in the function ReadPSDLayersInternal in coders/psd.c allowed attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file (bsc#1055063) - CVE-2017-12563: A memory exhaustion vulnerability in the function ReadPSDImage in coders/psd.c allowed attackers to cause a denial of service (bsc#1052460) - CVE-2017-14174: coders/psd.c allowed for DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might have caused huge CPU consumption. When a crafted PSD file, which claims a large 'length' field in the header but did not contain sufficient backing data, is provided, the loop over 'length' would consume huge CPU resources, since there is no EOF check inside the loop (bsc#1057723) - CVE-2017-15277: ReadGIFImage in coders/gif.c left the palette uninitialized when processing a GIF file that has neither a global nor local palette. If this functionality was used as a library loaded into a process that operates on interesting data, this data sometimes could have been leaked via the uninitialized palette (bsc#1063050) - CVE-2017-14733: ReadRLEImage in coders/rle.c mishandled RLE headers that specified too few colors, which allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file (bsc#1060577). - CVE-2017-12662: Fixed a memory leak vulnerability in WritePDFImage in coders/pdf.c (bsc#1052758). - CVE-2017-14994: ReadDCMImage in coders/dcm.c allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image, related to the ability of DCM_ReadNonNativeImages to yield an image list with zero frames (bsc#1061587). - CVE-2017-12140: The ReadDCMImage function in coders\dcm.c had an integer signedness error leading to excessive memory consumption via a crafted DCM file (bsc#1051847). - CVE-2017-12644: Fixed memory leak vulnerability in ReadDCMImage in coders\dcm.c (bsc#1052764). - CVE-2017-11188: The ReadDPXImage function in coders\dpx.c had a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check (bsc#1048457). - CVE-2017-10799: When processing a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) could have occurred in ReadDPXImage() (bsc#1047054). - CVE-2017-11449: coders/mpc did not enable seekable streams and thus could not validate blob sizes, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin (bsc#1049373). - CVE-2017-11532: Prevent a memory leak vulnerability in the WriteMPCImage() function in coders/mpc.c via a crafted file allowing for DoS (bsc#1050129). - CVE-2017-12430: A memory exhaustion in the function ReadMPCImage in coders/mpc.c allowed attackers to cause DoS (bsc#1052252). - CVE-2017-12642: Prevent a memory leak vulnerability in ReadMPCImage in coders\mpc.c via crafted file allowing for DoS (bsc#1052771). - CVE-2017-14249: A mishandled EOF check in ReadMPCImage in coders/mpc.c that lead to a division by zero in GetPixelCacheTileSize in MagickCore/cache.c allowed remote attackers to cause a denial of service via a crafted file (bsc#1058082). - CVE-2017-16547: The DrawImage function in magick/render.c did not properly look for pop keywords that are associated with push keywords, which allowed remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file (bsc#1067177). - Prevent memory leak via crafted file in pwp.c allowing for DoS (bsc#1051412) - CVE-2017-10800: Processing MATLAB images in coders/mat.c could have lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object was larger than the actual amount of data (bsc#1047044). - CVE-2017-18022: Fixed memory leak vulnerability in MontageImageCommand in MagickWand/montage.c (bsc#1074975). - CVE-2018-5247: Fixed memory leak vulnerability in ReadRLAImage in coders/rla.c (bsc#1074969). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13435,slestso13-GraphicsMagick-13435 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ Link for SUSE-SU-2018:0197-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003627.html E-Mail link for SUSE-SU-2018:0197-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047044 SUSE Bug 1047044 https://bugzilla.suse.com/1047054 SUSE Bug 1047054 https://bugzilla.suse.com/1048457 SUSE Bug 1048457 https://bugzilla.suse.com/1049373 SUSE Bug 1049373 https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1051412 SUSE Bug 1051412 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052252 SUSE Bug 1052252 https://bugzilla.suse.com/1052460 SUSE Bug 1052460 https://bugzilla.suse.com/1052758 SUSE Bug 1052758 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 https://bugzilla.suse.com/1052771 SUSE Bug 1052771 https://bugzilla.suse.com/1055063 SUSE Bug 1055063 https://bugzilla.suse.com/1056550 SUSE Bug 1056550 https://bugzilla.suse.com/1057723 SUSE Bug 1057723 https://bugzilla.suse.com/1058082 SUSE Bug 1058082 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1060577 SUSE Bug 1060577 https://bugzilla.suse.com/1061587 SUSE Bug 1061587 https://bugzilla.suse.com/1063050 SUSE Bug 1063050 https://bugzilla.suse.com/1067177 SUSE Bug 1067177 https://bugzilla.suse.com/1074969 SUSE Bug 1074969 https://bugzilla.suse.com/1074975 SUSE Bug 1074975 https://www.suse.com/security/cve/CVE-2017-10799/ SUSE CVE CVE-2017-10799 page https://www.suse.com/security/cve/CVE-2017-10800/ SUSE CVE CVE-2017-10800 page https://www.suse.com/security/cve/CVE-2017-11188/ SUSE CVE CVE-2017-11188 page https://www.suse.com/security/cve/CVE-2017-11449/ SUSE CVE CVE-2017-11449 page https://www.suse.com/security/cve/CVE-2017-11532/ SUSE CVE CVE-2017-11532 page https://www.suse.com/security/cve/CVE-2017-12140/ SUSE CVE CVE-2017-12140 page https://www.suse.com/security/cve/CVE-2017-12430/ SUSE CVE CVE-2017-12430 page https://www.suse.com/security/cve/CVE-2017-12563/ SUSE CVE CVE-2017-12563 page https://www.suse.com/security/cve/CVE-2017-12642/ SUSE CVE CVE-2017-12642 page https://www.suse.com/security/cve/CVE-2017-12644/ SUSE CVE CVE-2017-12644 page https://www.suse.com/security/cve/CVE-2017-12662/ SUSE CVE CVE-2017-12662 page https://www.suse.com/security/cve/CVE-2017-12691/ SUSE CVE CVE-2017-12691 page https://www.suse.com/security/cve/CVE-2017-13061/ SUSE CVE CVE-2017-13061 page https://www.suse.com/security/cve/CVE-2017-14042/ SUSE CVE CVE-2017-14042 page https://www.suse.com/security/cve/CVE-2017-14174/ SUSE CVE CVE-2017-14174 page https://www.suse.com/security/cve/CVE-2017-14249/ SUSE CVE CVE-2017-14249 page https://www.suse.com/security/cve/CVE-2017-14343/ SUSE CVE CVE-2017-14343 page https://www.suse.com/security/cve/CVE-2017-14733/ SUSE CVE CVE-2017-14733 page https://www.suse.com/security/cve/CVE-2017-14994/ SUSE CVE CVE-2017-14994 page https://www.suse.com/security/cve/CVE-2017-15277/ SUSE CVE CVE-2017-15277 page https://www.suse.com/security/cve/CVE-2017-16547/ SUSE CVE CVE-2017-16547 page https://www.suse.com/security/cve/CVE-2017-18022/ SUSE CVE CVE-2017-18022 page https://www.suse.com/security/cve/CVE-2018-5247/ SUSE CVE CVE-2018-5247 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-4.78.28.2 libGraphicsMagick2-1.2.5-4.78.28.2 perl-GraphicsMagick-1.2.5-4.78.28.2 GraphicsMagick-1.2.5-4.78.28.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-4.78.28.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-4.78.28.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-4.78.28.2 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-4.78.28.2 as a component of SUSE Studio Onsite 1.3 When GraphicsMagick 1.3.25 processes a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) can occur in ReadDPXImage(). CVE-2017-10799 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-10799.html CVE-2017-10799 https://bugzilla.suse.com/1047054 SUSE Bug 1047054 https://bugzilla.suse.com/1050116 SUSE Bug 1050116 When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object is larger than the actual amount of data. CVE-2017-10800 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-10800.html CVE-2017-10800 https://bugzilla.suse.com/1047044 SUSE Bug 1047044 The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check. CVE-2017-11188 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-11188.html CVE-2017-11188 https://bugzilla.suse.com/1048457 SUSE Bug 1048457 coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin. CVE-2017-11449 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-11449.html CVE-2017-11449 https://bugzilla.suse.com/1049373 SUSE Bug 1049373 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c. CVE-2017-11532 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-11532.html CVE-2017-11532 https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1050623 SUSE Bug 1050623 The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file. CVE-2017-12140 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12140.html CVE-2017-12140 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service. CVE-2017-12430 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12430.html CVE-2017-12430 https://bugzilla.suse.com/1052251 SUSE Bug 1052251 https://bugzilla.suse.com/1052252 SUSE Bug 1052252 In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service. CVE-2017-12563 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12563.html CVE-2017-12563 https://bugzilla.suse.com/1052460 SUSE Bug 1052460 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c. CVE-2017-12642 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12642.html CVE-2017-12642 https://bugzilla.suse.com/1052771 SUSE Bug 1052771 ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c. CVE-2017-12644 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12644.html CVE-2017-12644 https://bugzilla.suse.com/1051847 SUSE Bug 1051847 https://bugzilla.suse.com/1052764 SUSE Bug 1052764 ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c. CVE-2017-12662 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12662.html CVE-2017-12662 https://bugzilla.suse.com/1052758 SUSE Bug 1052758 The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-12691 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-12691.html CVE-2017-12691 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file. CVE-2017-13061 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-13061.html CVE-2017-13061 https://bugzilla.suse.com/1055063 SUSE Bug 1055063 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c. CVE-2017-14042 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14042.html CVE-2017-14042 https://bugzilla.suse.com/1054598 SUSE Bug 1054598 https://bugzilla.suse.com/1054600 SUSE Bug 1054600 https://bugzilla.suse.com/1056550 SUSE Bug 1056550 https://bugzilla.suse.com/1059721 SUSE Bug 1059721 In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. CVE-2017-14174 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14174.html CVE-2017-14174 https://bugzilla.suse.com/1057723 SUSE Bug 1057723 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file. CVE-2017-14249 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14249.html CVE-2017-14249 https://bugzilla.suse.com/1058082 SUSE Bug 1058082 ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file. CVE-2017-14343 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14343.html CVE-2017-14343 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2017-14733 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14733.html CVE-2017-14733 https://bugzilla.suse.com/1060577 SUSE Bug 1060577 ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image, related to the ability of DCM_ReadNonNativeImages to yield an image list with zero frames. CVE-2017-14994 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-14994.html CVE-2017-14994 https://bugzilla.suse.com/1061587 SUSE Bug 1061587 ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette. CVE-2017-15277 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-15277.html CVE-2017-15277 https://bugzilla.suse.com/1063050 SUSE Bug 1063050 The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file. CVE-2017-16547 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-16547.html CVE-2017-16547 https://bugzilla.suse.com/1067177 SUSE Bug 1067177 In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c. CVE-2017-18022 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2017-18022.html CVE-2017-18022 https://bugzilla.suse.com/1074969 SUSE Bug 1074969 https://bugzilla.suse.com/1074975 SUSE Bug 1074975 In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. CVE-2018-5247 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.28.2 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.28.2 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.28.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180197-1/ https://www.suse.com/security/cve/CVE-2018-5247.html CVE-2018-5247 https://bugzilla.suse.com/1074969 SUSE Bug 1074969 https://bugzilla.suse.com/1074975 SUSE Bug 1074975