Security update for GraphicsMagick SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:1123-1 Final 1 1 2018-05-02T06:23:41Z current 2018-05-02T06:23:41Z 2018-05-02T06:23:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GraphicsMagick This update for GraphicsMagick fixes the following issues: - security update (core) * CVE-2018-6799: The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used. [boo#1080522] - security update (png.c) * CVE-2018-9018: In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file. [boo#1086773] - security update (gif.c) * CVE-2017-18254: An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. [boo#1087027] - security update (pcd.c) * CVE-2017-18251: An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. [boo#1087037] * CVE-2017-18229: An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations. [boo#1085236] * CVE-2017-11641: GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.[boo#1050623] * CVE-2017-13066: GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c. [boo#1055010] * CVE-2018-10177: Specially crafted PNG images may have triggered an infinite loop [bsc#1089781] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html E-Mail link for openSUSE-SU-2018:1123-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 GraphicsMagick-1.3.25-87.1 GraphicsMagick-devel-1.3.25-87.1 libGraphicsMagick++-Q16-12-1.3.25-87.1 libGraphicsMagick++-devel-1.3.25-87.1 libGraphicsMagick-Q16-3-1.3.25-87.1 libGraphicsMagick3-config-1.3.25-87.1 libGraphicsMagickWand-Q16-2-1.3.25-87.1 perl-GraphicsMagick-1.3.25-87.1 GraphicsMagick-1.3.25-87.1 as a component of openSUSE Leap 42.3 GraphicsMagick-devel-1.3.25-87.1 as a component of openSUSE Leap 42.3 libGraphicsMagick++-Q16-12-1.3.25-87.1 as a component of openSUSE Leap 42.3 libGraphicsMagick++-devel-1.3.25-87.1 as a component of openSUSE Leap 42.3 libGraphicsMagick-Q16-3-1.3.25-87.1 as a component of openSUSE Leap 42.3 libGraphicsMagick3-config-1.3.25-87.1 as a component of openSUSE Leap 42.3 libGraphicsMagickWand-Q16-2-1.3.25-87.1 as a component of openSUSE Leap 42.3 perl-GraphicsMagick-1.3.25-87.1 as a component of openSUSE Leap 42.3 GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files. CVE-2017-11641 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2017-11641.html CVE-2017-11641 https://bugzilla.suse.com/1050129 SUSE Bug 1050129 https://bugzilla.suse.com/1050623 SUSE Bug 1050623 GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c. CVE-2017-13066 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2017-13066.html CVE-2017-13066 https://bugzilla.suse.com/1036988 SUSE Bug 1036988 https://bugzilla.suse.com/1055010 SUSE Bug 1055010 An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations. CVE-2017-18229 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2017-18229.html CVE-2017-18229 https://bugzilla.suse.com/1076182 SUSE Bug 1076182 https://bugzilla.suse.com/1085236 SUSE Bug 1085236 An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. CVE-2017-18251 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 low Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2017-18251.html CVE-2017-18251 https://bugzilla.suse.com/1087037 SUSE Bug 1087037 An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. CVE-2017-18254 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 low Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2017-18254.html CVE-2017-18254 https://bugzilla.suse.com/1087027 SUSE Bug 1087027 In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. CVE-2018-10177 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2018-10177.html CVE-2018-10177 https://bugzilla.suse.com/1089781 SUSE Bug 1089781 The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used. CVE-2018-6799 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2018-6799.html CVE-2018-6799 https://bugzilla.suse.com/1080522 SUSE Bug 1080522 In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file. CVE-2018-9018 openSUSE Leap 42.3:GraphicsMagick-1.3.25-87.1 openSUSE Leap 42.3:GraphicsMagick-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-Q16-12-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick++-devel-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick-Q16-3-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagick3-config-1.3.25-87.1 openSUSE Leap 42.3:libGraphicsMagickWand-Q16-2-1.3.25-87.1 openSUSE Leap 42.3:perl-GraphicsMagick-1.3.25-87.1 low Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-05/msg00003.html https://www.suse.com/security/cve/CVE-2018-9018.html CVE-2018-9018 https://bugzilla.suse.com/1086773 SUSE Bug 1086773