Security update for ImageMagick SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2750-1 Final 1 1 2020-09-25T09:37:26Z current 2020-09-25T09:37:26Z 2020-09-25T09:37:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ImageMagick This update for ImageMagick fixes the following issues: - CVE-2017-11527: Fixed a denial of service inReadDPXImage() (bsc#1047054). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2750,SUSE-SLE-SDK-12-SP5-2020-2750,SUSE-SLE-SERVER-12-SP5-2020-2750,SUSE-SLE-WE-12-SP5-2020-2750 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202750-1/ Link for SUSE-SU-2020:2750-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007482.html E-Mail link for SUSE-SU-2020:2750-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047054 SUSE Bug 1047054 https://www.suse.com/security/cve/CVE-2017-11527/ SUSE CVE CVE-2017-11527 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 ImageMagick-6.8.8.1-71.144.8 ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 ImageMagick-config-6-upstream-6.8.8.1-71.144.8 ImageMagick-devel-6.8.8.1-71.144.8 ImageMagick-devel-32bit-6.8.8.1-71.144.8 ImageMagick-devel-64bit-6.8.8.1-71.144.8 ImageMagick-doc-6.8.8.1-71.144.8 ImageMagick-extra-6.8.8.1-71.144.8 libMagick++-6_Q16-3-6.8.8.1-71.144.8 libMagick++-6_Q16-3-32bit-6.8.8.1-71.144.8 libMagick++-6_Q16-3-64bit-6.8.8.1-71.144.8 libMagick++-devel-6.8.8.1-71.144.8 libMagick++-devel-32bit-6.8.8.1-71.144.8 libMagick++-devel-64bit-6.8.8.1-71.144.8 libMagickCore-6_Q16-1-6.8.8.1-71.144.8 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.144.8 libMagickCore-6_Q16-1-64bit-6.8.8.1-71.144.8 libMagickWand-6_Q16-1-6.8.8.1-71.144.8 libMagickWand-6_Q16-1-32bit-6.8.8.1-71.144.8 libMagickWand-6_Q16-1-64bit-6.8.8.1-71.144.8 perl-PerlMagick-6.8.8.1-71.144.8 ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server 12 SP5 ImageMagick-config-6-upstream-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server 12 SP5 libMagickCore-6_Q16-1-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server 12 SP5 libMagickWand-6_Q16-1-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server 12 SP5 ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ImageMagick-config-6-upstream-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libMagickCore-6_Q16-1-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libMagickWand-6_Q16-1-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ImageMagick-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ImageMagick-config-6-upstream-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ImageMagick-devel-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libMagick++-6_Q16-3-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libMagick++-devel-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 perl-PerlMagick-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 ImageMagick-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libMagick++-6_Q16-3-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.144.8 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. CVE-2017-11527 SUSE Linux Enterprise Server 12 SP5:ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 SUSE Linux Enterprise Server 12 SP5:ImageMagick-config-6-upstream-6.8.8.1-71.144.8 SUSE Linux Enterprise Server 12 SP5:libMagickCore-6_Q16-1-6.8.8.1-71.144.8 SUSE Linux Enterprise Server 12 SP5:libMagickWand-6_Q16-1-6.8.8.1-71.144.8 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ImageMagick-config-6-upstream-6.8.8.1-71.144.8 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libMagickCore-6_Q16-1-6.8.8.1-71.144.8 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libMagickWand-6_Q16-1-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:ImageMagick-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:ImageMagick-config-6-SUSE-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:ImageMagick-config-6-upstream-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:ImageMagick-devel-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:libMagick++-6_Q16-3-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:libMagick++-devel-6.8.8.1-71.144.8 SUSE Linux Enterprise Software Development Kit 12 SP5:perl-PerlMagick-6.8.8.1-71.144.8 SUSE Linux Enterprise Workstation Extension 12 SP5:ImageMagick-6.8.8.1-71.144.8 SUSE Linux Enterprise Workstation Extension 12 SP5:libMagick++-6_Q16-3-6.8.8.1-71.144.8 SUSE Linux Enterprise Workstation Extension 12 SP5:libMagickCore-6_Q16-1-32bit-6.8.8.1-71.144.8 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202750-1/ https://www.suse.com/security/cve/CVE-2017-11527.html CVE-2017-11527 https://bugzilla.suse.com/1047054 SUSE Bug 1047054 https://bugzilla.suse.com/1050116 SUSE Bug 1050116