Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2465-1 Final 1 1 2018-08-21T06:42:49Z current 2018-08-21T06:42:49Z 2018-08-21T06:42:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-11251: Heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service (bsc#1094237) - CVE-2017-18271: Infinite loop in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (bsc#1094204) - CVE-2017-13758: Heap-based buffer overflow in the TracePoint() in MagickCore/draw.c, which allows attackers to cause a denial of service(bsc#1056277) - CVE-2018-10805: Fixed several memory leaks in rgb.c, cmyk.c, gray.c, and ycbcr.c (bsc#1095812) - CVE-2018-12600: The ReadDIBImage and WriteDIBImage functions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098545) - CVE-2018-12599: The ReadBMPImage and WriteBMPImage fucntions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098546) - CVE-2018-14434: Fixed a memory leak for a colormap in WriteMPCImage in coders/mpc.c (bsc#1102003) - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (bsc#1102007) - CVE-2018-14436: Fixed a memory leak in ReadMIFFImage in coders/miff.c (bsc#1102005) - CVE-2018-14437: Fixed a memory leak in parse8BIM in coders/meta.c (bsc#1102004) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ImageMagick-13747,slessp4-ImageMagick-13747 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ Link for SUSE-SU-2018:2465-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004481.html E-Mail link for SUSE-SU-2018:2465-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1056277 SUSE Bug 1056277 https://bugzilla.suse.com/1094204 SUSE Bug 1094204 https://bugzilla.suse.com/1094237 SUSE Bug 1094237 https://bugzilla.suse.com/1095812 SUSE Bug 1095812 https://bugzilla.suse.com/1098545 SUSE Bug 1098545 https://bugzilla.suse.com/1098546 SUSE Bug 1098546 https://bugzilla.suse.com/1102003 SUSE Bug 1102003 https://bugzilla.suse.com/1102004 SUSE Bug 1102004 https://bugzilla.suse.com/1102005 SUSE Bug 1102005 https://bugzilla.suse.com/1102007 SUSE Bug 1102007 https://www.suse.com/security/cve/CVE-2017-13758/ SUSE CVE CVE-2017-13758 page https://www.suse.com/security/cve/CVE-2017-18271/ SUSE CVE CVE-2017-18271 page https://www.suse.com/security/cve/CVE-2018-10805/ SUSE CVE CVE-2018-10805 page https://www.suse.com/security/cve/CVE-2018-11251/ SUSE CVE CVE-2018-11251 page https://www.suse.com/security/cve/CVE-2018-12599/ SUSE CVE CVE-2018-12599 page https://www.suse.com/security/cve/CVE-2018-12600/ SUSE CVE CVE-2018-12600 page https://www.suse.com/security/cve/CVE-2018-14434/ SUSE CVE CVE-2018-14434 page https://www.suse.com/security/cve/CVE-2018-14435/ SUSE CVE CVE-2018-14435 page https://www.suse.com/security/cve/CVE-2018-14436/ SUSE CVE CVE-2018-14436 page https://www.suse.com/security/cve/CVE-2018-14437/ SUSE CVE CVE-2018-14437 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-6.4.3.6-78.56.1 ImageMagick-devel-6.4.3.6-78.56.1 libMagick++-devel-6.4.3.6-78.56.1 libMagick++1-6.4.3.6-78.56.1 libMagickWand1-6.4.3.6-78.56.1 libMagickWand1-32bit-6.4.3.6-78.56.1 perl-PerlMagick-6.4.3.6-78.56.1 libMagickCore1-6.4.3.6-78.56.1 libMagickCore1-32bit-6.4.3.6-78.56.1 libMagickCore1-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-32bit-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libMagickCore1-32bit-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ImageMagick-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-devel-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++-devel-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++1-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-32bit-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-PerlMagick-6.4.3.6-78.56.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c. CVE-2017-13758 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2017-13758.html CVE-2017-13758 https://bugzilla.suse.com/1056277 SUSE Bug 1056277 https://bugzilla.suse.com/1096261 SUSE Bug 1096261 In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file. CVE-2017-18271 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2017-18271.html CVE-2017-18271 https://bugzilla.suse.com/1094204 SUSE Bug 1094204 ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. CVE-2018-10805 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-10805.html CVE-2018-10805 https://bugzilla.suse.com/1095812 SUSE Bug 1095812 In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file. CVE-2018-11251 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-11251.html CVE-2018-11251 https://bugzilla.suse.com/1094237 SUSE Bug 1094237 In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. CVE-2018-12599 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-12599.html CVE-2018-12599 https://bugzilla.suse.com/1098546 SUSE Bug 1098546 https://bugzilla.suse.com/1117463 SUSE Bug 1117463 In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. CVE-2018-12600 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-12600.html CVE-2018-12600 https://bugzilla.suse.com/1098545 SUSE Bug 1098545 https://bugzilla.suse.com/1098546 SUSE Bug 1098546 https://bugzilla.suse.com/1117463 SUSE Bug 1117463 ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. CVE-2018-14434 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-14434.html CVE-2018-14434 https://bugzilla.suse.com/1102003 SUSE Bug 1102003 ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. CVE-2018-14435 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-14435.html CVE-2018-14435 https://bugzilla.suse.com/1102007 SUSE Bug 1102007 ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. CVE-2018-14436 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-14436.html CVE-2018-14436 https://bugzilla.suse.com/1102005 SUSE Bug 1102005 ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. CVE-2018-14437 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.56.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182465-1/ https://www.suse.com/security/cve/CVE-2018-14437.html CVE-2018-14437 https://bugzilla.suse.com/1102004 SUSE Bug 1102004