Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0413-1 Final 1 1 2018-02-09T14:54:21Z current 2018-02-09T14:54:21Z 2018-02-09T14:54:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2017-13065: Prevent NULL pointer dereference in the function SVGStartElement (bsc#1055038). - CVE-2018-5685: Prevent infinite loop and application hang in the ReadBMPImage function. Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value (bsc#1075939). - CVE-2017-9262: The ReadJNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043353) - CVE-2017-9261: The ReadMNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043354) - CVE-2017-10995: The mng_get_long function in coders/png.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image (bsc#1047908) - CVE-2017-11102: The ReadOneJNGImage function allowed remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length color_image data structure (bsc#1047910). - CVE-2017-11539: Prevent memory leak in the ReadOnePNGImage() function in coders/png.c (bsc#1050037) - CVE-2017-11505: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file (bsc#1050072) - CVE-2017-11526: The ReadOneMNGImage function in coders/png.c allowed remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file (bsc#1050100) - CVE-2017-11750: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1051442) - CVE-2017-12565: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052470) - CVE-2017-12676: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052708) - CVE-2017-12673: Prevent memory leak in the function ReadOneMNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052717) - CVE-2017-12643: Prevent a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052768) - CVE-2017-12641: Prevent a memory leak vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052777) - CVE-2017-12640: Prevent an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c (bsc#1052781) - CVE-2017-12935: The ReadMNGImage function in coders/png.c mishandled large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c (bsc#1054600) - CVE-2017-13147: Prevent allocation failure in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value (bsc#1055374) - CVE-2017-13142: Added additional checks for short files to prevent a crafted PNG file from triggering a crash (bsc#1055455) - CVE-2017-13141: Prevent memory leak in ReadOnePNGImage in coders/png.c (bsc#1055456) - CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c did not properly manage image pointers after certain error conditions, which allowed remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call (bsc#1057000) - CVE-2017-14649: ReadOneJNGImage in coders/png.c did not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash) (bsc#1060162) - CVE-2017-15218: Prevent memory leak in ReadOneJNGImage in coders/png.c (bsc#1062752) - CVE-2017-15238: ReadOneJNGImage had a use-after-free issue when the height or width is zero, related to ReadJNGImage (bsc#1067198). - CVE-2017-17782: Prevent heap-based buffer over-read in ReadOneJNGImage related to oFFs chunk allocation (bsc#1073690). - CVE-2017-17501: WriteOnePNGImage had a heap-based buffer over-read that could be triggered via a crafted file (bsc#1074023). - CVE-2017-17884: Prevent memory leak in the function WriteOnePNGImage in coders/png.c, which allowed attackers to cause a denial of service via a crafted PNG image file (bsc#1074120) - CVE-2017-17879: Prevent heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error (bsc#1074125) - CVE-2017-17915: Prevent heap-based buffer over-read in ReadMNGImage when accessing one byte testing whether a limit has been reached (bsc#1074175). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13461,slestso13-GraphicsMagick-13461 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ Link for SUSE-SU-2018:0413-1 https://lists.suse.com/pipermail/sle-security-updates/2018-February/003719.html E-Mail link for SUSE-SU-2018:0413-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1043353 SUSE Bug 1043353 https://bugzilla.suse.com/1043354 SUSE Bug 1043354 https://bugzilla.suse.com/1047908 SUSE Bug 1047908 https://bugzilla.suse.com/1047910 SUSE Bug 1047910 https://bugzilla.suse.com/1050037 SUSE Bug 1050037 https://bugzilla.suse.com/1050072 SUSE Bug 1050072 https://bugzilla.suse.com/1050100 SUSE Bug 1050100 https://bugzilla.suse.com/1051442 SUSE Bug 1051442 https://bugzilla.suse.com/1052470 SUSE Bug 1052470 https://bugzilla.suse.com/1052708 SUSE Bug 1052708 https://bugzilla.suse.com/1052717 SUSE Bug 1052717 https://bugzilla.suse.com/1052768 SUSE Bug 1052768 https://bugzilla.suse.com/1052777 SUSE Bug 1052777 https://bugzilla.suse.com/1052781 SUSE Bug 1052781 https://bugzilla.suse.com/1054600 SUSE Bug 1054600 https://bugzilla.suse.com/1055038 SUSE Bug 1055038 https://bugzilla.suse.com/1055374 SUSE Bug 1055374 https://bugzilla.suse.com/1055455 SUSE Bug 1055455 https://bugzilla.suse.com/1055456 SUSE Bug 1055456 https://bugzilla.suse.com/1057000 SUSE Bug 1057000 https://bugzilla.suse.com/1060162 SUSE Bug 1060162 https://bugzilla.suse.com/1062752 SUSE Bug 1062752 https://bugzilla.suse.com/1067198 SUSE Bug 1067198 https://bugzilla.suse.com/1073690 SUSE Bug 1073690 https://bugzilla.suse.com/1074023 SUSE Bug 1074023 https://bugzilla.suse.com/1074120 SUSE Bug 1074120 https://bugzilla.suse.com/1074125 SUSE Bug 1074125 https://bugzilla.suse.com/1074175 SUSE Bug 1074175 https://bugzilla.suse.com/1075939 SUSE Bug 1075939 https://www.suse.com/security/cve/CVE-2014-9811/ SUSE CVE CVE-2014-9811 page https://www.suse.com/security/cve/CVE-2017-10995/ SUSE CVE CVE-2017-10995 page https://www.suse.com/security/cve/CVE-2017-11102/ SUSE CVE CVE-2017-11102 page https://www.suse.com/security/cve/CVE-2017-11505/ SUSE CVE CVE-2017-11505 page https://www.suse.com/security/cve/CVE-2017-11526/ SUSE CVE CVE-2017-11526 page https://www.suse.com/security/cve/CVE-2017-11539/ SUSE CVE CVE-2017-11539 page https://www.suse.com/security/cve/CVE-2017-11750/ SUSE CVE CVE-2017-11750 page https://www.suse.com/security/cve/CVE-2017-12565/ SUSE CVE CVE-2017-12565 page https://www.suse.com/security/cve/CVE-2017-12640/ SUSE CVE CVE-2017-12640 page https://www.suse.com/security/cve/CVE-2017-12641/ SUSE CVE CVE-2017-12641 page https://www.suse.com/security/cve/CVE-2017-12643/ SUSE CVE CVE-2017-12643 page https://www.suse.com/security/cve/CVE-2017-12673/ SUSE CVE CVE-2017-12673 page https://www.suse.com/security/cve/CVE-2017-12676/ SUSE CVE CVE-2017-12676 page https://www.suse.com/security/cve/CVE-2017-12935/ SUSE CVE CVE-2017-12935 page https://www.suse.com/security/cve/CVE-2017-13065/ SUSE CVE CVE-2017-13065 page https://www.suse.com/security/cve/CVE-2017-13141/ SUSE CVE CVE-2017-13141 page https://www.suse.com/security/cve/CVE-2017-13142/ SUSE CVE CVE-2017-13142 page https://www.suse.com/security/cve/CVE-2017-13147/ SUSE CVE CVE-2017-13147 page https://www.suse.com/security/cve/CVE-2017-14103/ SUSE CVE CVE-2017-14103 page https://www.suse.com/security/cve/CVE-2017-14174/ SUSE CVE CVE-2017-14174 page https://www.suse.com/security/cve/CVE-2017-14649/ SUSE CVE CVE-2017-14649 page https://www.suse.com/security/cve/CVE-2017-15218/ SUSE CVE CVE-2017-15218 page https://www.suse.com/security/cve/CVE-2017-15238/ SUSE CVE CVE-2017-15238 page https://www.suse.com/security/cve/CVE-2017-16669/ SUSE CVE CVE-2017-16669 page https://www.suse.com/security/cve/CVE-2017-17501/ SUSE CVE CVE-2017-17501 page https://www.suse.com/security/cve/CVE-2017-17504/ SUSE CVE CVE-2017-17504 page https://www.suse.com/security/cve/CVE-2017-17782/ SUSE CVE CVE-2017-17782 page https://www.suse.com/security/cve/CVE-2017-17879/ SUSE CVE CVE-2017-17879 page https://www.suse.com/security/cve/CVE-2017-17884/ SUSE CVE CVE-2017-17884 page https://www.suse.com/security/cve/CVE-2017-17915/ SUSE CVE CVE-2017-17915 page https://www.suse.com/security/cve/CVE-2017-8352/ SUSE CVE CVE-2017-8352 page https://www.suse.com/security/cve/CVE-2017-9261/ SUSE CVE CVE-2017-9261 page https://www.suse.com/security/cve/CVE-2017-9262/ SUSE CVE CVE-2017-9262 page https://www.suse.com/security/cve/CVE-2018-5685/ SUSE CVE CVE-2018-5685 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-4.78.33.1 libGraphicsMagick2-1.2.5-4.78.33.1 perl-GraphicsMagick-1.2.5-4.78.33.1 GraphicsMagick-1.2.5-4.78.33.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-4.78.33.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-4.78.33.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-4.78.33.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-4.78.33.1 as a component of SUSE Studio Onsite 1.3 The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file. CVE-2014-9811 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2014-9811.html CVE-2014-9811 https://bugzilla.suse.com/982969 SUSE Bug 982969 https://bugzilla.suse.com/984032 SUSE Bug 984032 The mng_get_long function in coders/png.c in ImageMagick 7.0.6-0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image. CVE-2017-10995 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-10995.html CVE-2017-10995 https://bugzilla.suse.com/1047908 SUSE Bug 1047908 The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length color_image data structure. CVE-2017-11102 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-11102.html CVE-2017-11102 https://bugzilla.suse.com/1047910 SUSE Bug 1047910 https://bugzilla.suse.com/1057000 SUSE Bug 1057000 https://bugzilla.suse.com/1107619 SUSE Bug 1107619 The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a malformed JNG file. CVE-2017-11505 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-11505.html CVE-2017-11505 https://bugzilla.suse.com/1050072 SUSE Bug 1050072 https://bugzilla.suse.com/1050100 SUSE Bug 1050100 The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file. CVE-2017-11526 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-11526.html CVE-2017-11526 https://bugzilla.suse.com/1050072 SUSE Bug 1050072 https://bugzilla.suse.com/1050100 SUSE Bug 1050100 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadOnePNGImage() function in coders/png.c. CVE-2017-11539 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-11539.html CVE-2017-11539 https://bugzilla.suse.com/1050037 SUSE Bug 1050037 The ReadOneJNGImage function in coders/png.c in ImageMagick 6.9.9-4 and 7.0.6-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. CVE-2017-11750 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-11750.html CVE-2017-11750 https://bugzilla.suse.com/1047910 SUSE Bug 1047910 https://bugzilla.suse.com/1051442 SUSE Bug 1051442 In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service. CVE-2017-12565 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12565.html CVE-2017-12565 https://bugzilla.suse.com/1047910 SUSE Bug 1047910 https://bugzilla.suse.com/1052470 SUSE Bug 1052470 ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c. CVE-2017-12640 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12640.html CVE-2017-12640 https://bugzilla.suse.com/1052781 SUSE Bug 1052781 ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c. CVE-2017-12641 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12641.html CVE-2017-12641 https://bugzilla.suse.com/1052777 SUSE Bug 1052777 ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c. CVE-2017-12643 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12643.html CVE-2017-12643 https://bugzilla.suse.com/1052768 SUSE Bug 1052768 In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service. CVE-2017-12673 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12673.html CVE-2017-12673 https://bugzilla.suse.com/1052717 SUSE Bug 1052717 In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service. CVE-2017-12676 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12676.html CVE-2017-12676 https://bugzilla.suse.com/1052708 SUSE Bug 1052708 The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. CVE-2017-12935 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-12935.html CVE-2017-12935 https://bugzilla.suse.com/1054598 SUSE Bug 1054598 https://bugzilla.suse.com/1054600 SUSE Bug 1054600 GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c. CVE-2017-13065 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-13065.html CVE-2017-13065 https://bugzilla.suse.com/1054598 SUSE Bug 1054598 https://bugzilla.suse.com/1054600 SUSE Bug 1054600 https://bugzilla.suse.com/1055038 SUSE Bug 1055038 In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c. CVE-2017-13141 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-13141.html CVE-2017-13141 https://bugzilla.suse.com/1055456 SUSE Bug 1055456 https://bugzilla.suse.com/1060162 SUSE Bug 1060162 In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files. CVE-2017-13142 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-13142.html CVE-2017-13142 https://bugzilla.suse.com/1055455 SUSE Bug 1055455 In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value. CVE-2017-13147 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-13147.html CVE-2017-13147 https://bugzilla.suse.com/1055374 SUSE Bug 1055374 The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403. CVE-2017-14103 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-14103.html CVE-2017-14103 https://bugzilla.suse.com/1057000 SUSE Bug 1057000 In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. CVE-2017-14174 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-14174.html CVE-2017-14174 https://bugzilla.suse.com/1057723 SUSE Bug 1057723 https://bugzilla.suse.com/1072901 SUSE Bug 1072901 ReadOneJNGImage in coders/png.c in GraphicsMagick version 1.3.26 does not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash). CVE-2017-14649 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-14649.html CVE-2017-14649 https://bugzilla.suse.com/1060162 SUSE Bug 1060162 ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c. CVE-2017-15218 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-15218.html CVE-2017-15218 https://bugzilla.suse.com/1047910 SUSE Bug 1047910 https://bugzilla.suse.com/1062752 SUSE Bug 1062752 ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage. CVE-2017-15238 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-15238.html CVE-2017-15238 https://bugzilla.suse.com/1067198 SUSE Bug 1067198 coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c. CVE-2017-16669 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-16669.html CVE-2017-16669 https://bugzilla.suse.com/1067409 SUSE Bug 1067409 https://bugzilla.suse.com/1072898 SUSE Bug 1072898 WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file. CVE-2017-17501 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17501.html CVE-2017-17501 https://bugzilla.suse.com/1074023 SUSE Bug 1074023 ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage. CVE-2017-17504 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17504.html CVE-2017-17504 https://bugzilla.suse.com/1072362 SUSE Bug 1072362 In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation. CVE-2017-17782 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17782.html CVE-2017-17782 https://bugzilla.suse.com/1073690 SUSE Bug 1073690 In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error. CVE-2017-17879 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17879.html CVE-2017-17879 https://bugzilla.suse.com/1074125 SUSE Bug 1074125 https://bugzilla.suse.com/1074175 SUSE Bug 1074175 In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file. CVE-2017-17884 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17884.html CVE-2017-17884 https://bugzilla.suse.com/1074120 SUSE Bug 1074120 In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached. CVE-2017-17915 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-17915.html CVE-2017-17915 https://bugzilla.suse.com/1074125 SUSE Bug 1074125 https://bugzilla.suse.com/1074175 SUSE Bug 1074175 In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-8352 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-8352.html CVE-2017-8352 https://bugzilla.suse.com/1036987 SUSE Bug 1036987 In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-9261 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-9261.html CVE-2017-9261 https://bugzilla.suse.com/1043354 SUSE Bug 1043354 In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-9262 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2017-9262.html CVE-2017-9262 https://bugzilla.suse.com/1043353 SUSE Bug 1043353 In GraphicsMagick 1.3.27, there is an infinite loop and application hang in the ReadBMPImage function (coders/bmp.c). Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value. CVE-2018-5685 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.33.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.33.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180413-1/ https://www.suse.com/security/cve/CVE-2018-5685.html CVE-2018-5685 https://bugzilla.suse.com/1075939 SUSE Bug 1075939