Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:0399-1

Опубликовано: 06 фев. 2017
Источник: suse-cvrf

Описание

Security update for GraphicsMagick

This update for GraphicsMagick fixes several issues.

These security issues were fixed:

  • CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310)
  • CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312)
  • CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313)
  • CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314)
  • CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324)
  • CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)
  • CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443)
  • CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448)

Список пакетов

openSUSE Leap 42.2
GraphicsMagick-1.3.25-9.1
GraphicsMagick-devel-1.3.25-9.1
libGraphicsMagick++-Q16-12-1.3.25-9.1
libGraphicsMagick++-devel-1.3.25-9.1
libGraphicsMagick-Q16-3-1.3.25-9.1
libGraphicsMagick3-config-1.3.25-9.1
libGraphicsMagickWand-Q16-2-1.3.25-9.1
perl-GraphicsMagick-1.3.25-9.1

Ссылки

Описание

Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки

Описание

coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.

Затронутые продукты
openSUSE Leap 42.2:GraphicsMagick-1.3.25-9.1
openSUSE Leap 42.2:GraphicsMagick-devel-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-Q16-12-1.3.25-9.1
openSUSE Leap 42.2:libGraphicsMagick++-devel-1.3.25-9.1
Ссылки
Уязвимость openSUSE-SU-2017:0399-1