Mailinglist Archive: opensuse-updates (145 mails)

< Previous Next >
openSUSE-SU-2018:1123-1: moderate: Security update for GraphicsMagick
openSUSE Security Update: Security update for GraphicsMagick
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:1123-1
Rating: moderate
References: #1050623 #1055010 #1080522 #1085236 #1086773
#1087027 #1087037 #1089781
Cross-References: CVE-2017-11641 CVE-2017-13066 CVE-2017-18229
CVE-2017-18251 CVE-2017-18254 CVE-2018-10177
CVE-2018-6799 CVE-2018-9018
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes 8 vulnerabilities is now available.

Description:

This update for GraphicsMagick fixes the following issues:

- security update (core)
* CVE-2018-6799: The AcquireCacheNexus function in magick/pixel_cache.c
in GraphicsMagick before 1.3.28 allows remote attackers to cause a
denial of service (heap overwrite) or possibly have unspecified other
impact via a crafted image file, because a pixel staging area is not
used. [boo#1080522]

- security update (png.c)
* CVE-2018-9018: In GraphicsMagick 1.3.28, there is a divide-by-zero in
the ReadMNGImage function of coders/png.c. Remote attackers could
leverage this vulnerability to cause a crash and denial of service via
a crafted mng file. [boo#1086773]

- security update (gif.c)
* CVE-2017-18254: An issue was discovered in ImageMagick 7.0.7. A memory
leak vulnerability was found in the function WriteGIFImage in
coders/gif.c, which allow remote attackers to cause a denial of
service via a crafted file. [boo#1087027]

- security update (pcd.c)
* CVE-2017-18251: An issue was discovered in ImageMagick 7.0.7. A memory
leak vulnerability was found in the function ReadPCDImage in
coders/pcd.c, which allow remote attackers to cause a denial of
service via a crafted file. [boo#1087037]

* CVE-2017-18229: An issue was discovered in GraphicsMagick 1.3.26. An
allocation failure vulnerability was found in the function
ReadTIFFImage in coders/tiff.c, which allows attackers to cause a
denial of service via a crafted file, because file size is not
properly used to restrict scanline, strip, and tile allocations.
[boo#1085236]

* CVE-2017-11641: GraphicsMagick 1.3.26 has a Memory Leak in the
PersistCache function in magick/pixel_cache.c during writing of Magick
Persistent Cache (MPC) files.[boo#1050623]

* CVE-2017-13066: GraphicsMagick 1.3.26 has a memory leak vulnerability
in the function CloneImage in magick/image.c. [boo#1055010]

* CVE-2018-10177: Specially crafted PNG images may have triggered an
infinite loop [bsc#1089781]


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended
installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-407=1



Package List:

- openSUSE Leap 42.3 (i586 x86_64):

GraphicsMagick-1.3.25-87.1
GraphicsMagick-debuginfo-1.3.25-87.1
GraphicsMagick-debugsource-1.3.25-87.1
GraphicsMagick-devel-1.3.25-87.1
libGraphicsMagick++-Q16-12-1.3.25-87.1
libGraphicsMagick++-Q16-12-debuginfo-1.3.25-87.1
libGraphicsMagick++-devel-1.3.25-87.1
libGraphicsMagick-Q16-3-1.3.25-87.1
libGraphicsMagick-Q16-3-debuginfo-1.3.25-87.1
libGraphicsMagick3-config-1.3.25-87.1
libGraphicsMagickWand-Q16-2-1.3.25-87.1
libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-87.1
perl-GraphicsMagick-1.3.25-87.1
perl-GraphicsMagick-debuginfo-1.3.25-87.1


References:

https://www.suse.com/security/cve/CVE-2017-11641.html
https://www.suse.com/security/cve/CVE-2017-13066.html
https://www.suse.com/security/cve/CVE-2017-18229.html
https://www.suse.com/security/cve/CVE-2017-18251.html
https://www.suse.com/security/cve/CVE-2017-18254.html
https://www.suse.com/security/cve/CVE-2018-10177.html
https://www.suse.com/security/cve/CVE-2018-6799.html
https://www.suse.com/security/cve/CVE-2018-9018.html
https://bugzilla.suse.com/1050623
https://bugzilla.suse.com/1055010
https://bugzilla.suse.com/1080522
https://bugzilla.suse.com/1085236
https://bugzilla.suse.com/1086773
https://bugzilla.suse.com/1087027
https://bugzilla.suse.com/1087037
https://bugzilla.suse.com/1089781


< Previous Next >
This Thread
  • No further messages