Описание
Security update for GraphicsMagick
This update for GraphicsMagick fixes several issues.
These security issues were fixed:
- CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310).
- CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311).
- CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312).
- CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313).
- CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318).
- CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321).
- CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322).
- CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324).
- CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326).
- CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443).
- CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448).
Список пакетов
SUSE Linux Enterprise Software Development Kit 11 SP4
SUSE Studio Onsite 1.3
Ссылки
- Link for SUSE-SU-2017:0518-1
- E-Mail link for SUSE-SU-2017:0518-1
- SUSE Security Ratings
- SUSE Bug 1017310
- SUSE Bug 1017311
- SUSE Bug 1017312
- SUSE Bug 1017313
- SUSE Bug 1017318
- SUSE Bug 1017321
- SUSE Bug 1017322
- SUSE Bug 1017324
- SUSE Bug 1017326
- SUSE Bug 1020443
- SUSE Bug 1020448
- SUSE CVE CVE-2016-10048 page
- SUSE CVE CVE-2016-10049 page
- SUSE CVE CVE-2016-10050 page
- SUSE CVE CVE-2016-10051 page
- SUSE CVE CVE-2016-10059 page
- SUSE CVE CVE-2016-10064 page
Описание
Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.
Затронутые продукты
Ссылки
- CVE-2016-10048
- SUSE Bug 1017310
Описание
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
Затронутые продукты
Ссылки
- CVE-2016-10049
- SUSE Bug 1017311
Описание
Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
Затронутые продукты
Ссылки
- CVE-2016-10050
- SUSE Bug 1017312
Описание
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Затронутые продукты
Ссылки
- CVE-2016-10051
- SUSE Bug 1017313
Описание
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a crafted TIFF file.
Затронутые продукты
Ссылки
- CVE-2016-10059
- SUSE Bug 1017318
Описание
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Затронутые продукты
Ссылки
- CVE-2016-10064
- SUSE Bug 1016590
- SUSE Bug 1017321
Описание
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Затронутые продукты
Ссылки
- CVE-2016-10065
- SUSE Bug 1016591
- SUSE Bug 1017322
Описание
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.
Затронутые продукты
Ссылки
- CVE-2016-10068
- SUSE Bug 1017324
Описание
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
Затронутые продукты
Ссылки
- CVE-2016-10070
- SUSE Bug 1017326
Описание
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Затронутые продукты
Ссылки
- CVE-2016-10146
- SUSE Bug 1020443
Описание
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
Затронутые продукты
Ссылки
- CVE-2017-5511
- SUSE Bug 1020448