Security update for GraphicsMagick
SUSE Patch
security@suse.de
SUSE Security Team
openSUSE-SU-2017:0399-1
Final
1
1
2017-02-06T10:52:35Z
current
2017-02-06T10:52:35Z
2017-02-06T10:52:35Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for GraphicsMagick
This update for GraphicsMagick fixes several issues.
These security issues were fixed:
- CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310)
- CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312)
- CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313)
- CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314)
- CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324)
- CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)
- CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443)
- CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448)
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
E-Mail link for openSUSE-SU-2017:0399-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
openSUSE Leap 42.2
GraphicsMagick-1.3.25-9.1
GraphicsMagick-devel-1.3.25-9.1
libGraphicsMagick++-Q16-12-1.3.25-9.1
libGraphicsMagick++-devel-1.3.25-9.1
libGraphicsMagick-Q16-3-1.3.25-9.1
libGraphicsMagick3-config-1.3.25-9.1
libGraphicsMagickWand-Q16-2-1.3.25-9.1
perl-GraphicsMagick-1.3.25-9.1
GraphicsMagick-1.3.25-9.1 as a component of openSUSE Leap 42.2
GraphicsMagick-devel-1.3.25-9.1 as a component of openSUSE Leap 42.2
libGraphicsMagick++-Q16-12-1.3.25-9.1 as a component of openSUSE Leap 42.2
libGraphicsMagick++-devel-1.3.25-9.1 as a component of openSUSE Leap 42.2
libGraphicsMagick-Q16-3-1.3.25-9.1 as a component of openSUSE Leap 42.2
libGraphicsMagick3-config-1.3.25-9.1 as a component of openSUSE Leap 42.2
libGraphicsMagickWand-Q16-2-1.3.25-9.1 as a component of openSUSE Leap 42.2
perl-GraphicsMagick-1.3.25-9.1 as a component of openSUSE Leap 42.2
Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.
CVE-2016-10048
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10048.html
CVE-2016-10048
https://bugzilla.suse.com/1017310
SUSE Bug 1017310
Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
CVE-2016-10050
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10050.html
CVE-2016-10050
https://bugzilla.suse.com/1017312
SUSE Bug 1017312
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVE-2016-10051
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10051.html
CVE-2016-10051
https://bugzilla.suse.com/1017313
SUSE Bug 1017313
Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVE-2016-10052
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
5.8
AV:N/AC:M/Au:N/C:N/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10052.html
CVE-2016-10052
https://bugzilla.suse.com/1017314
SUSE Bug 1017314
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.
CVE-2016-10068
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
low
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10068.html
CVE-2016-10068
https://bugzilla.suse.com/1017324
SUSE Bug 1017324
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
CVE-2016-10070
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
low
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10070.html
CVE-2016-10070
https://bugzilla.suse.com/1017326
SUSE Bug 1017326
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVE-2016-10146
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2016-10146.html
CVE-2016-10146
https://bugzilla.suse.com/1020443
SUSE Bug 1020443
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
CVE-2017-5511
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick-Q16-3-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick3-config-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagickWand-Q16-2-1.3.25-9.1
openSUSE Leap 42.2:perl-GraphicsMagick-1.3.25-9.1
moderate
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html
https://www.suse.com/security/cve/CVE-2017-5511.html
CVE-2017-5511
https://bugzilla.suse.com/1020448
SUSE Bug 1020448