Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0524-1 Final 1 1 2018-02-22T10:51:37Z current 2018-02-22T10:51:37Z 2018-02-22T10:51:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes the following issues: - CVE-2017-9407: The ReadPALMImage function in palm.c allowed attackers to cause a denial of service (memory leak) via a crafted file. (bsc#1042824) - CVE-2017-11140: coders/jpeg.c allowed remote attackers to cause a denial of service (application crash). [boo#1047900] - CVE-2017-11448: The ReadJPEGImage function in coders/jpeg.c allowed remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. (bsc#1049375) - CVE-2017-11450: A remote denial of service in coders/jpeg.c was fixed [boo#1049374] - CVE-2017-11637: A NULL pointer dereference in WritePCLImage() in coders/pcl.c was fixed which could lead to a crash (bsc#1050669) - CVE-2017-11638, CVE-2017-11642: A NULL pointer dereference in theWriteMAPImage() in coders/map.c was fixed which could lead to a crash (bsc#1050617) - CVE-2017-12427: ProcessMSLScript coders/msl.c allowed remote attackers to cause a DoS (bsc#1052248) - CVE-2017-12429: A memory exhaustion flaw in ReadMIFFImage in coders/miff.c was fixed, which allowed attackers to cause DoS (bsc#1052251) - CVE-2017-12432: A memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allowed attackers to cause a denial of service. (bsc#1052254) - CVE-2017-12566: A memory leak in ReadMVGImage in coders/mvg.c, could have allowed attackers to cause DoS (bsc#1052472) - CVE-2017-12668: A memory leak vulnerability in WritePCXImage in coders/pcx.c. (bsc#1052688) - CVE-2017-13058: A memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allowed attackers to cause a denial of service via a crafted file. (bsc#1055069) - CVE-2017-13131: A memory leak vulnerability was found in thefunction ReadMIFFImage in coders/miff.c, which allowed attackers tocause a denial of service (memory consumption in NewL (bsc#1055229) - CVE-2017-14224: A heap-based buffer overflow in WritePCXImage in coders/pcx.c could lead to denial of service or code execution. [boo#1058009] - CVE-2017-17502: ReadCMYKImage in ImportCMYKQuantumType had a heap-based buffer over-read via a crafted file. [boo#1073081] - CVE-2017-17912: A heap-based buffer over-read in ReadNewsProfile in coders/tiff.c was fixed. [boo#1074307] - CVE-2017-18028: A memory exhaustion in the function ReadTIFFImage in coders/tiff.c was fixed. [boo#1076182] - CVE-2018-6405: In the ReadDCMImage function in coders/dcm.c, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allowed remote attackers to cause a denial of service. (bsc#1078433) - CVE-2017-17503: A heap-based buffer overflow in the ReadGRAYImage was fixed (bsc#1072934) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13481,slestso13-GraphicsMagick-13481 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ Link for SUSE-SU-2018:0524-1 https://lists.suse.com/pipermail/sle-security-updates/2018-February/003749.html E-Mail link for SUSE-SU-2018:0524-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1042824 SUSE Bug 1042824 https://bugzilla.suse.com/1047900 SUSE Bug 1047900 https://bugzilla.suse.com/1049374 SUSE Bug 1049374 https://bugzilla.suse.com/1049375 SUSE Bug 1049375 https://bugzilla.suse.com/1050617 SUSE Bug 1050617 https://bugzilla.suse.com/1050669 SUSE Bug 1050669 https://bugzilla.suse.com/1052248 SUSE Bug 1052248 https://bugzilla.suse.com/1052251 SUSE Bug 1052251 https://bugzilla.suse.com/1052254 SUSE Bug 1052254 https://bugzilla.suse.com/1052472 SUSE Bug 1052472 https://bugzilla.suse.com/1052688 SUSE Bug 1052688 https://bugzilla.suse.com/1055069 SUSE Bug 1055069 https://bugzilla.suse.com/1055229 SUSE Bug 1055229 https://bugzilla.suse.com/1058009 SUSE Bug 1058009 https://bugzilla.suse.com/1072934 SUSE Bug 1072934 https://bugzilla.suse.com/1073081 SUSE Bug 1073081 https://bugzilla.suse.com/1074307 SUSE Bug 1074307 https://bugzilla.suse.com/1076182 SUSE Bug 1076182 https://bugzilla.suse.com/1078433 SUSE Bug 1078433 https://www.suse.com/security/cve/CVE-2017-11140/ SUSE CVE CVE-2017-11140 page https://www.suse.com/security/cve/CVE-2017-11448/ SUSE CVE CVE-2017-11448 page https://www.suse.com/security/cve/CVE-2017-11450/ SUSE CVE CVE-2017-11450 page https://www.suse.com/security/cve/CVE-2017-11637/ SUSE CVE CVE-2017-11637 page https://www.suse.com/security/cve/CVE-2017-11638/ SUSE CVE CVE-2017-11638 page https://www.suse.com/security/cve/CVE-2017-11642/ SUSE CVE CVE-2017-11642 page https://www.suse.com/security/cve/CVE-2017-12427/ SUSE CVE CVE-2017-12427 page https://www.suse.com/security/cve/CVE-2017-12429/ SUSE CVE CVE-2017-12429 page https://www.suse.com/security/cve/CVE-2017-12432/ SUSE CVE CVE-2017-12432 page https://www.suse.com/security/cve/CVE-2017-12566/ SUSE CVE CVE-2017-12566 page https://www.suse.com/security/cve/CVE-2017-12668/ SUSE CVE CVE-2017-12668 page https://www.suse.com/security/cve/CVE-2017-13058/ SUSE CVE CVE-2017-13058 page https://www.suse.com/security/cve/CVE-2017-13131/ SUSE CVE CVE-2017-13131 page https://www.suse.com/security/cve/CVE-2017-14224/ SUSE CVE CVE-2017-14224 page https://www.suse.com/security/cve/CVE-2017-17502/ SUSE CVE CVE-2017-17502 page https://www.suse.com/security/cve/CVE-2017-17503/ SUSE CVE CVE-2017-17503 page https://www.suse.com/security/cve/CVE-2017-17912/ SUSE CVE CVE-2017-17912 page https://www.suse.com/security/cve/CVE-2017-18028/ SUSE CVE CVE-2017-18028 page https://www.suse.com/security/cve/CVE-2017-9407/ SUSE CVE CVE-2017-9407 page https://www.suse.com/security/cve/CVE-2018-6405/ SUSE CVE CVE-2018-6405 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-4.78.38.1 libGraphicsMagick2-1.2.5-4.78.38.1 perl-GraphicsMagick-1.2.5-4.78.38.1 GraphicsMagick-1.2.5-4.78.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-4.78.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-4.78.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-4.78.38.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-4.78.38.1 as a component of SUSE Studio Onsite 1.3 The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files. CVE-2017-11140 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11140.html CVE-2017-11140 https://bugzilla.suse.com/1047900 SUSE Bug 1047900 The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. CVE-2017-11448 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11448.html CVE-2017-11448 https://bugzilla.suse.com/1049375 SUSE Bug 1049375 coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short. CVE-2017-11450 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11450.html CVE-2017-11450 https://bugzilla.suse.com/1049374 SUSE Bug 1049374 GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images. CVE-2017-11637 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11637.html CVE-2017-11637 https://bugzilla.suse.com/1050669 SUSE Bug 1050669 GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642. CVE-2017-11638 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11638.html CVE-2017-11638 https://bugzilla.suse.com/1050617 SUSE Bug 1050617 GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638. CVE-2017-11642 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-11642.html CVE-2017-11642 https://bugzilla.suse.com/1050617 SUSE Bug 1050617 The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function. CVE-2017-12427 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-12427.html CVE-2017-12427 https://bugzilla.suse.com/1052248 SUSE Bug 1052248 In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service. CVE-2017-12429 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-12429.html CVE-2017-12429 https://bugzilla.suse.com/1052251 SUSE Bug 1052251 In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service. CVE-2017-12432 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-12432.html CVE-2017-12432 https://bugzilla.suse.com/1052254 SUSE Bug 1052254 In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service, related to the function ReadSVGImage in svg.c. CVE-2017-12566 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-12566.html CVE-2017-12566 https://bugzilla.suse.com/1052472 SUSE Bug 1052472 ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. CVE-2017-12668 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-12668.html CVE-2017-12668 https://bugzilla.suse.com/1052688 SUSE Bug 1052688 In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause a denial of service via a crafted file. CVE-2017-13058 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-13058.html CVE-2017-13058 https://bugzilla.suse.com/1055069 SUSE Bug 1055069 https://bugzilla.suse.com/1111072 SUSE Bug 1111072 https://bugzilla.suse.com/1117463 SUSE Bug 1117463 In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file. CVE-2017-13131 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-13131.html CVE-2017-13131 https://bugzilla.suse.com/1055229 SUSE Bug 1055229 A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file. CVE-2017-14224 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-14224.html CVE-2017-14224 https://bugzilla.suse.com/1058009 SUSE Bug 1058009 ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17502 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-17502.html CVE-2017-17502 https://bugzilla.suse.com/1073081 SUSE Bug 1073081 https://bugzilla.suse.com/1077737 SUSE Bug 1077737 ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17503 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-17503.html CVE-2017-17503 https://bugzilla.suse.com/1072934 SUSE Bug 1072934 https://bugzilla.suse.com/1073081 SUSE Bug 1073081 https://bugzilla.suse.com/1077737 SUSE Bug 1077737 In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c, in which LocaleNCompare reads heap data beyond the allocated region. CVE-2017-17912 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-17912.html CVE-2017-17912 https://bugzilla.suse.com/1074307 SUSE Bug 1074307 In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file. CVE-2017-18028 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-18028.html CVE-2017-18028 https://bugzilla.suse.com/1076182 SUSE Bug 1076182 https://bugzilla.suse.com/1082792 SUSE Bug 1082792 https://bugzilla.suse.com/1085236 SUSE Bug 1085236 In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-9407 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2017-9407.html CVE-2017-9407 https://bugzilla.suse.com/1042824 SUSE Bug 1042824 In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service. CVE-2018-6405 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.38.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180524-1/ https://www.suse.com/security/cve/CVE-2018-6405.html CVE-2018-6405 https://bugzilla.suse.com/1078433 SUSE Bug 1078433 https://bugzilla.suse.com/1095726 SUSE Bug 1095726