Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3808-1 Final 1 1 2018-11-19T10:29:35Z current 2018-11-19T10:29:35Z 2018-11-19T10:29:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes the following issues: - CVE-2017-14997: ImageMagick allowed remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. (bsc#1112399) - CVE-2018-16644: A regression in the security fix for the pict coder was fixed (bsc#1107609) - CVE-2017-11532: When ImageMagick processed a crafted file in convert, it could lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c. (bsc#1050129) - CVE-2017-11639: A regression in the security fix in the cip coder was fixed (bsc#1050635) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ImageMagick-13868,slessp4-ImageMagick-13868 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183808-1/ Link for SUSE-SU-2018:3808-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004863.html E-Mail link for SUSE-SU-2018:3808-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1050635 SUSE Bug 1050635 https://bugzilla.suse.com/1107609 SUSE Bug 1107609 https://bugzilla.suse.com/1112399 SUSE Bug 1112399 https://www.suse.com/security/cve/CVE-2017-11532/ SUSE CVE CVE-2017-11532 page https://www.suse.com/security/cve/CVE-2017-11639/ SUSE CVE CVE-2017-11639 page https://www.suse.com/security/cve/CVE-2017-14997/ SUSE CVE CVE-2017-14997 page https://www.suse.com/security/cve/CVE-2018-16644/ SUSE CVE CVE-2018-16644 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-6.4.3.6-78.79.1 ImageMagick-devel-6.4.3.6-78.79.1 libMagick++-devel-6.4.3.6-78.79.1 libMagick++1-6.4.3.6-78.79.1 libMagickWand1-6.4.3.6-78.79.1 libMagickWand1-32bit-6.4.3.6-78.79.1 perl-PerlMagick-6.4.3.6-78.79.1 libMagickCore1-6.4.3.6-78.79.1 libMagickCore1-32bit-6.4.3.6-78.79.1 libMagickCore1-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-32bit-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Server 11 SP4 libMagickCore1-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libMagickCore1-32bit-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ImageMagick-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ImageMagick-devel-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++-devel-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagick++1-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libMagickWand1-32bit-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 perl-PerlMagick-6.4.3.6-78.79.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c. CVE-2017-11532 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.79.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183808-1/ https://www.suse.com/security/cve/CVE-2017-11532.html CVE-2017-11532 https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1050623 SUSE Bug 1050623 When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h. CVE-2017-11639 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.79.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183808-1/ https://www.suse.com/security/cve/CVE-2017-11639.html CVE-2017-11639 https://bugzilla.suse.com/1050635 SUSE Bug 1050635 GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. CVE-2017-14997 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.79.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183808-1/ https://www.suse.com/security/cve/CVE-2017-14997.html CVE-2017-14997 https://bugzilla.suse.com/1112399 SUSE Bug 1112399 https://bugzilla.suse.com/1117463 SUSE Bug 1117463 There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image. CVE-2018-16644 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libMagickCore1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ImageMagick-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++-devel-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagick++1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-32bit-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libMagickWand1-6.4.3.6-78.79.1 SUSE Linux Enterprise Software Development Kit 11 SP4:perl-PerlMagick-6.4.3.6-78.79.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183808-1/ https://www.suse.com/security/cve/CVE-2018-16644.html CVE-2018-16644 https://bugzilla.suse.com/1107609 SUSE Bug 1107609 https://bugzilla.suse.com/1107612 SUSE Bug 1107612 https://bugzilla.suse.com/1117463 SUSE Bug 1117463