Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1163-1 Final 1 1 2018-05-08T08:24:41Z current 2018-05-08T08:24:41Z 2018-05-08T08:24:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes the following issues: * CVE-2017-18229: An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which could allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations. [bsc#1085236] * CVE-2017-11641: A memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files could lead to denial of servic3. [bsc#1050623] * CVE-2017-13066: A memory leak vulnerability in the function CloneImage in magick/image.c could lead to denial of service [bsc#1055010] * CVE-2018-10177: An infinite loop when reading MNG was fixed which could lead to a denial of service (hang) [bsc#1089781] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-GraphicsMagick-13590,slestso13-GraphicsMagick-13590 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ Link for SUSE-SU-2018:1163-1 https://lists.suse.com/pipermail/sle-security-updates/2018-May/003976.html E-Mail link for SUSE-SU-2018:1163-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1050623 SUSE Bug 1050623 https://bugzilla.suse.com/1055010 SUSE Bug 1055010 https://bugzilla.suse.com/1085236 SUSE Bug 1085236 https://bugzilla.suse.com/1089781 SUSE Bug 1089781 https://www.suse.com/security/cve/CVE-2017-11641/ SUSE CVE CVE-2017-11641 page https://www.suse.com/security/cve/CVE-2017-13066/ SUSE CVE CVE-2017-13066 page https://www.suse.com/security/cve/CVE-2017-18229/ SUSE CVE CVE-2017-18229 page https://www.suse.com/security/cve/CVE-2018-10177/ SUSE CVE CVE-2018-10177 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 GraphicsMagick-1.2.5-78.52.1 libGraphicsMagick2-1.2.5-78.52.1 perl-GraphicsMagick-1.2.5-78.52.1 GraphicsMagick-1.2.5-78.52.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libGraphicsMagick2-1.2.5-78.52.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-GraphicsMagick-1.2.5-78.52.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 GraphicsMagick-1.2.5-78.52.1 as a component of SUSE Studio Onsite 1.3 libGraphicsMagick2-1.2.5-78.52.1 as a component of SUSE Studio Onsite 1.3 GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files. CVE-2017-11641 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.52.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ https://www.suse.com/security/cve/CVE-2017-11641.html CVE-2017-11641 https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1050623 SUSE Bug 1050623 GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c. CVE-2017-13066 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.52.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ https://www.suse.com/security/cve/CVE-2017-13066.html CVE-2017-13066 https://bugzilla.suse.com/1036988 SUSE Bug 1036988 https://bugzilla.suse.com/1055010 SUSE Bug 1055010 An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations. CVE-2017-18229 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.52.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ https://www.suse.com/security/cve/CVE-2017-18229.html CVE-2017-18229 https://bugzilla.suse.com/1076182 SUSE Bug 1076182 https://bugzilla.suse.com/1085236 SUSE Bug 1085236 In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. CVE-2018-10177 SUSE Linux Enterprise Software Development Kit 11 SP4:GraphicsMagick-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libGraphicsMagick2-1.2.5-78.52.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:GraphicsMagick-1.2.5-78.52.1 SUSE Studio Onsite 1.3:libGraphicsMagick2-1.2.5-78.52.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ https://www.suse.com/security/cve/CVE-2018-10177.html CVE-2018-10177 https://bugzilla.suse.com/1089781 SUSE Bug 1089781