Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0770-1 Final 1 1 2018-03-22T07:18:34Z current 2018-03-22T07:18:34Z 2018-03-22T07:18:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9405: A memory leak in the ReadICONImage function was fixed that could lead to DoS via memory exhaustion (bsc#1042911) - CVE-2017-11528: ReadDIBImage in coders/dib.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050119) - CVE-2017-11530: ReadEPTImage in coders/ept.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050122) - CVE-2017-11533: A information leak by 1 byte due to heap-based buffer over-read in the WriteUILImage() in coders/uil.c was fixed (bsc#1050132) - CVE-2017-12663: A memory leak in WriteMAPImage in coders/map.c was fixed that could lead to a DoS via memory exhaustion (bsc#1052754) - CVE-2017-17682: A large loop vulnerability was fixed in ExtractPostscript in coders/wpg.c, which allowed attackers to cause a denial of service (CPU exhaustion) (bsc#1072898) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ImageMagick-13526,slessp4-ImageMagick-13526 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ Link for SUSE-SU-2018:0770-1 https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1.html E-Mail link for SUSE-SU-2018:0770-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1042911 SUSE Bug 1042911 https://bugzilla.suse.com/1050119 SUSE Bug 1050119 https://bugzilla.suse.com/1050122 SUSE Bug 1050122 https://bugzilla.suse.com/1050132 SUSE Bug 1050132 https://bugzilla.suse.com/1052754 SUSE Bug 1052754 https://bugzilla.suse.com/1072898 SUSE Bug 1072898 https://www.suse.com/security/cve/CVE-2017-11528/ SUSE CVE CVE-2017-11528 page https://www.suse.com/security/cve/CVE-2017-11530/ SUSE CVE CVE-2017-11530 page https://www.suse.com/security/cve/CVE-2017-11533/ SUSE CVE CVE-2017-11533 page https://www.suse.com/security/cve/CVE-2017-12663/ SUSE CVE CVE-2017-12663 page https://www.suse.com/security/cve/CVE-2017-17682/ SUSE CVE CVE-2017-17682 page https://www.suse.com/security/cve/CVE-2017-9405/ SUSE CVE CVE-2017-9405 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-6.4.3.6-7.78.37.1 ImageMagick-devel-6.4.3.6-7.78.37.1 libMagick++-devel-6.4.3.6-7.78.37.1 libMagick++1-6.4.3.6-7.78.37.1 libMagickWand1-6.4.3.6-7.78.37.1 libMagickWand1-32bit-6.4.3.6-7.78.37.1 perl-PerlMagick-6.4.3.6-7.78.37.1 libMagickCore1-6.4.3.6-7.78.37.1 libMagickCore1-32bit-6.4.3.6-7.78.37.1 libMagickCore1-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libMagickCore1-32bit-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ImageMagick-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-devel-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++-devel-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++1-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-32bit-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-PerlMagick-6.4.3.6-7.78.37.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The ReadDIBImage function in coders/dib.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-11528 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-11528.html CVE-2017-11528 https://bugzilla.suse.com/1050119 SUSE Bug 1050119 The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-11530 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-11530.html CVE-2017-11530 https://bugzilla.suse.com/1050122 SUSE Bug 1050122 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c. CVE-2017-11533 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-11533.html CVE-2017-11533 https://bugzilla.suse.com/1050132 SUSE Bug 1050132 ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c. CVE-2017-12663 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-12663.html CVE-2017-12663 https://bugzilla.suse.com/1052754 SUSE Bug 1052754 In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call. CVE-2017-17682 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-17682.html CVE-2017-17682 https://bugzilla.suse.com/1072898 SUSE Bug 1072898 In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file. CVE-2017-9405 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-7.78.37.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-7.78.37.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180770-1/ https://www.suse.com/security/cve/CVE-2017-9405.html CVE-2017-9405 https://bugzilla.suse.com/1042911 SUSE Bug 1042911