Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:1603-1

Опубликовано: 24 июн. 2019
Источник: suse-cvrf

Описание

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

Security issues fixed:

  • CVE-2019-11472: Fixed a denial-of-service in ReadXWDImage() (bsc#1133204).
  • CVE-2019-11470: Fixed a denial-of-service in ReadCINImage() (bsc#1133205).
  • CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABImage() (bsc#1133498).
  • CVE-2019-11505: Fixed a heap-based buffer overflow in the WritePDBImage() (bsc#1133501).
  • CVE-2019-11598: Fixed a heap-based buffer overread in WritePNMImage() (bsc#1136732)

We also now disable PCL in the -SUSE configuration, as it also uses ghostscript for decoding (bsc#1136183)

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
ImageMagick-7.0.7.34-lp151.7.3.1
ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
ImageMagick-devel-7.0.7.34-lp151.7.3.1
ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
ImageMagick-doc-7.0.7.34-lp151.7.3.1
ImageMagick-extra-7.0.7.34-lp151.7.3.1
libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.3.1
libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.3.1
libMagick++-devel-7.0.7.34-lp151.7.3.1
libMagick++-devel-32bit-7.0.7.34-lp151.7.3.1
libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.3.1
libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.3.1
libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.3.1
libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.3.1
perl-PerlMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.1
ImageMagick-7.0.7.34-lp151.7.3.1
ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
ImageMagick-devel-7.0.7.34-lp151.7.3.1
ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
ImageMagick-doc-7.0.7.34-lp151.7.3.1
ImageMagick-extra-7.0.7.34-lp151.7.3.1
libMagick++-7_Q16HDRI4-7.0.7.34-lp151.7.3.1
libMagick++-7_Q16HDRI4-32bit-7.0.7.34-lp151.7.3.1
libMagick++-devel-7.0.7.34-lp151.7.3.1
libMagick++-devel-32bit-7.0.7.34-lp151.7.3.1
libMagickCore-7_Q16HDRI6-7.0.7.34-lp151.7.3.1
libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.3.1
libMagickWand-7_Q16HDRI6-7.0.7.34-lp151.7.3.1
libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-lp151.7.3.1
perl-PerlMagick-7.0.7.34-lp151.7.3.1

Ссылки

Описание

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.

Затронутые продукты
openSUSE Leap 15.0:ImageMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
Ссылки

Описание

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.

Затронутые продукты
openSUSE Leap 15.0:ImageMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
Ссылки

Описание

In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.

Затронутые продукты
openSUSE Leap 15.0:ImageMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
Ссылки

Описание

In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.

Затронутые продукты
openSUSE Leap 15.0:ImageMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
Ссылки

Описание

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.

Затронутые продукты
openSUSE Leap 15.0:ImageMagick-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-SUSE-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-config-7-upstream-7.0.7.34-lp151.7.3.1
openSUSE Leap 15.0:ImageMagick-devel-32bit-7.0.7.34-lp151.7.3.1
Ссылки
Уязвимость openSUSE-SU-2019:1603-1