Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0864-1 Final 1 1 2018-04-03T15:17:14Z current 2018-04-03T15:17:14Z 2018-04-03T15:17:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2017-11524: The WriteBlob function allowed remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file (bsc#1050087) - CVE-2017-16353: Prevent memory information disclosure in the DescribeImage function caused by a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments were never checked (bsc#1066170) - CVE-2017-16352: Prevent a heap-based buffer overflow in the 'Display visual image directory' feature of the DescribeImage() function. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag (bsc#1066168) - CVE-2017-14314: Prevent off-by-one error in the DrawImage function that allowed remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file (bsc#1058630) - CVE-2017-14505: Fixed handling of NULL arrays, which allowed attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input (bsc#1059735) - CVE-2017-15016: Prevent NULL pointer dereference vulnerability in ReadEnhMetaFile allowing for denial of service (bsc#1082291) - CVE-2017-15017: Prevent NULL pointer dereference vulnerability in ReadOneMNGImage allowing for denial of service (bsc#1082283) - CVE-2017-12693: The ReadBMPImage function allowed remote attackers to cause a denial of service (memory consumption) via a crafted BMP file (bsc#1082348) - CVE-2017-18219: Prevent allocation failure in the function ReadOnePNGImage, which allowed attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation (bsc#1084060) - CVE-2017-18230: Prevent NULL pointer dereference in the function ReadCINEONImage, which allowed attackers to cause a denial of service via a crafted file (bsc#1085233). - CVE-2017-18220: The ReadOneJNGImage and ReadJNGImage functions allowed remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file (bsc#1084062). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13543,slestso13-GraphicsMagick-13543 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ Link for SUSE-SU-2018:0864-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003865.html E-Mail link for SUSE-SU-2018:0864-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1050087 SUSE Bug 1050087 https://bugzilla.suse.com/1058630 SUSE Bug 1058630 https://bugzilla.suse.com/1059735 SUSE Bug 1059735 https://bugzilla.suse.com/1066168 SUSE Bug 1066168 https://bugzilla.suse.com/1066170 SUSE Bug 1066170 https://bugzilla.suse.com/1082283 SUSE Bug 1082283 https://bugzilla.suse.com/1082291 SUSE Bug 1082291 https://bugzilla.suse.com/1082348 SUSE Bug 1082348 https://bugzilla.suse.com/1084060 SUSE Bug 1084060 https://bugzilla.suse.com/1084062 SUSE Bug 1084062 https://bugzilla.suse.com/1085233 SUSE Bug 1085233 https://www.suse.com/security/cve/CVE-2017-11524/ SUSE CVE CVE-2017-11524 page https://www.suse.com/security/cve/CVE-2017-12691/ SUSE CVE CVE-2017-12691 page https://www.suse.com/security/cve/CVE-2017-12693/ SUSE CVE CVE-2017-12693 page https://www.suse.com/security/cve/CVE-2017-14314/ SUSE CVE CVE-2017-14314 page https://www.suse.com/security/cve/CVE-2017-14343/ SUSE CVE CVE-2017-14343 page https://www.suse.com/security/cve/CVE-2017-14505/ SUSE CVE CVE-2017-14505 page https://www.suse.com/security/cve/CVE-2017-15016/ SUSE CVE CVE-2017-15016 page https://www.suse.com/security/cve/CVE-2017-15017/ SUSE CVE CVE-2017-15017 page https://www.suse.com/security/cve/CVE-2017-16352/ SUSE CVE CVE-2017-16352 page https://www.suse.com/security/cve/CVE-2017-16353/ SUSE CVE CVE-2017-16353 page https://www.suse.com/security/cve/CVE-2017-18219/ SUSE CVE CVE-2017-18219 page https://www.suse.com/security/cve/CVE-2017-18220/ SUSE CVE CVE-2017-18220 page https://www.suse.com/security/cve/CVE-2017-18230/ SUSE CVE CVE-2017-18230 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-78.44.1 libGraphicsMagick2-1.2.5-78.44.1 perl-GraphicsMagick-1.2.5-78.44.1 GraphicsMagick-1.2.5-78.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-78.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-78.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-78.44.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-78.44.1 as a component of SUSE Studio Onsite 1.3 The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file. CVE-2017-11524 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-11524.html CVE-2017-11524 https://bugzilla.suse.com/1050087 SUSE Bug 1050087 The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-12691 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-12691.html CVE-2017-12691 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file. CVE-2017-12693 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-12693.html CVE-2017-12693 https://bugzilla.suse.com/1053955 SUSE Bug 1053955 https://bugzilla.suse.com/1082348 SUSE Bug 1082348 Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file. CVE-2017-14314 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-14314.html CVE-2017-14314 https://bugzilla.suse.com/1058630 SUSE Bug 1058630 ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file. CVE-2017-14343 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-14343.html CVE-2017-14343 https://bugzilla.suse.com/1058422 SUSE Bug 1058422 https://bugzilla.suse.com/1082363 SUSE Bug 1082363 DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input. CVE-2017-14505 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-14505.html CVE-2017-14505 https://bugzilla.suse.com/1059735 SUSE Bug 1059735 ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c. CVE-2017-15016 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-15016.html CVE-2017-15016 https://bugzilla.suse.com/1082291 SUSE Bug 1082291 ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c. CVE-2017-15017 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-15017.html CVE-2017-15017 https://bugzilla.suse.com/1082283 SUSE Bug 1082283 GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag. CVE-2017-16352 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-16352.html CVE-2017-16352 https://bugzilla.suse.com/1066168 SUSE Bug 1066168 https://bugzilla.suse.com/1066170 SUSE Bug 1066170 GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked. CVE-2017-16353 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-16353.html CVE-2017-16353 https://bugzilla.suse.com/1066170 SUSE Bug 1066170 An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation. CVE-2017-18219 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-18219.html CVE-2017-18219 https://bugzilla.suse.com/1084060 SUSE Bug 1084060 The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file, a related issue to CVE-2017-11403. CVE-2017-18220 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-18220.html CVE-2017-18220 https://bugzilla.suse.com/1084062 SUSE Bug 1084062 An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadCINEONImage in coders/cineon.c, which allows attackers to cause a denial of service via a crafted file. CVE-2017-18230 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.44.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.44.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180864-1/ https://www.suse.com/security/cve/CVE-2017-18230.html CVE-2017-18230 https://bugzilla.suse.com/1085233 SUSE Bug 1085233