Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0672-1 Final 1 1 2018-03-14T16:01:58Z current 2018-03-14T16:01:58Z 2018-03-14T16:01:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2017-9405: A memory leak in the ReadICONImage function was fixed that could lead to DoS via memory exhaustion (bsc#1042911) - CVE-2017-11528: ReadDIBImage in coders/dib.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050119) - CVE-2017-11533: A information leak by 1 byte due to heap-based buffer over-read in the WriteUILImage() in coders/uil.c was fixed (bsc#1050132) - CVE-2017-12663: A memory leak in WriteMAPImage in coders/map.c was fixed that could lead to a DoS via memory exhaustion (bsc#1052754) - CVE-2017-17682: A large loop vulnerability was fixed in ExtractPostscript in coders/wpg.c, which allowed attackers to cause a denial of service (CPU exhaustion) (bsc#1072898) - CVE-2017-17500: A heap-based buffer overflow (read) in the ImportRGBQuantumType was fixed. (bsc#1077737) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13509,slestso13-GraphicsMagick-13509 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ Link for SUSE-SU-2018:0672-1 https://lists.suse.com/pipermail/sle-security-updates/2018-March/003810.html E-Mail link for SUSE-SU-2018:0672-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1042911 SUSE Bug 1042911 https://bugzilla.suse.com/1050119 SUSE Bug 1050119 https://bugzilla.suse.com/1050132 SUSE Bug 1050132 https://bugzilla.suse.com/1052754 SUSE Bug 1052754 https://bugzilla.suse.com/1072898 SUSE Bug 1072898 https://bugzilla.suse.com/1077737 SUSE Bug 1077737 https://www.suse.com/security/cve/CVE-2017-11528/ SUSE CVE CVE-2017-11528 page https://www.suse.com/security/cve/CVE-2017-11533/ SUSE CVE CVE-2017-11533 page https://www.suse.com/security/cve/CVE-2017-12663/ SUSE CVE CVE-2017-12663 page https://www.suse.com/security/cve/CVE-2017-17500/ SUSE CVE CVE-2017-17500 page https://www.suse.com/security/cve/CVE-2017-17682/ SUSE CVE CVE-2017-17682 page https://www.suse.com/security/cve/CVE-2017-9405/ SUSE CVE CVE-2017-9405 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-4.78.41.1 libGraphicsMagick2-1.2.5-4.78.41.1 perl-GraphicsMagick-1.2.5-4.78.41.1 GraphicsMagick-1.2.5-4.78.41.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-4.78.41.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-4.78.41.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-4.78.41.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-4.78.41.1 as a component of SUSE Studio Onsite 1.3 The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-11528 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-11528.html CVE-2017-11528 https://bugzilla.suse.com/1050119 SUSE Bug 1050119 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c. CVE-2017-11533 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-11533.html CVE-2017-11533 https://bugzilla.suse.com/1050132 SUSE Bug 1050132 ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c. CVE-2017-12663 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-12663.html CVE-2017-12663 https://bugzilla.suse.com/1052754 SUSE Bug 1052754 ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17500 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-17500.html CVE-2017-17500 https://bugzilla.suse.com/1077737 SUSE Bug 1077737 In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call. CVE-2017-17682 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-17682.html CVE-2017-17682 https://bugzilla.suse.com/1072898 SUSE Bug 1072898 In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-9405 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-4.78.41.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-4.78.41.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-4.78.41.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180672-1/ https://www.suse.com/security/cve/CVE-2017-9405.html CVE-2017-9405 https://bugzilla.suse.com/1042911 SUSE Bug 1042911