[oss-security] 20160614 Various invalid memory reads in ImageMagick (WPG, DDS, DCM)

[oss-security] 20160617 Re: Various invalid memory reads in ImageMagick (WPG, DDS, DCM)

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

91283

https://blog.fuzzing-project.org/46-Various-invalid-memory-reads-in-ImageMagick-WPG,-DDS,-DCM.html

https://github.com/ImageMagick/ImageMagick/blob/6.9.4-5/ChangeLog

https://github.com/ImageMagick/ImageMagick/blob/7.0.1-7/ChangeLog

https://github.com/ImageMagick/ImageMagick/commit/5511ef530576ed18fd636baa3bb4eda3d667665d

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The DCM reader in ImageMagick before 6.9.4-5 and 7.x     before 7.0.1-7 allows remote attackers to have     unspecified impact by leveraging lack of validation of     (1) pixel.red, (2) pixel.green, and (3)     pixel.blue.(CVE-2016-5691)

  - The ReadDCMImage function in DCM reader in ImageMagick     before 6.9.4-5 and 7.x before 7.0.1-7 allows remote     attackers to have unspecified impact via vectors     involving the for statement in computing the pixel     scaling table.(CVE-2016-5690)

  - The DCM reader in ImageMagick before 6.9.4-5 and 7.x     before 7.0.1-7 allows remote attackers to have     unspecified impact by leveraging lack of NULL pointer     checks.(CVE-2016-5689)

  - The VerticalFilter function in the DDS coder in     ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4     allows remote attackers to have unspecified impact via     a crafted DDS file, which triggers an out-of-bounds     read.(CVE-2016-5687)

  - coders/ipl.c in ImageMagick allows remote attackers to     have unspecific impact by leveraging a missing malloc     check.(CVE-2016-10144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ImageMagick was updated to fix 66 security issues.

These security issues were fixed :

  - CVE-2014-9810: SEGV in dpx file handler. (bsc#983803).

  - CVE-2014-9811: Crash in xwd file handler (bsc#984032).

  - CVE-2014-9812: NULL pointer dereference in ps file     handling (bsc#984137).

  - CVE-2014-9813: Crash on corrupted viff file     (bsc#984035).

  - CVE-2014-9814: NULL pointer dereference in wpg file     handling (bsc#984193).

  - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372).

  - CVE-2014-9816: Out of bound access in viff image     (bsc#984398).

  - CVE-2014-9817: Heap buffer overflow in pdb file handling     (bsc#984400).

  - CVE-2014-9818: Out of bound access on malformed sun file     (bsc#984181).

  - CVE-2014-9819: Heap overflow in palm files (bsc#984142).

  - CVE-2014-9830: Handling of corrupted sun file     (bsc#984135).

  - CVE-2014-9831: Handling of corrupted wpg file     (bsc#984375).

  - CVE-2014-9850: Incorrect thread limit logic     (bsc#984149).

  - CVE-2014-9851: Crash when parsing resource block     (bsc#984160).

  - CVE-2014-9852: Incorrect usage of object after it has     been destroyed (bsc#984191).

  - CVE-2014-9853: Memory leak in rle file handling     (bsc#984408).

  - CVE-2015-8902: PDB file DoS (CPU consumption)     (bsc#983253).

  - CVE-2015-8903: Denial of service (cpu) in vicar     (bsc#983259).

  - CVE-2015-8900: HDR file DoS (endless loop) (bsc#983232).

  - CVE-2015-8901: MIFF file DoS (endless loop)     (bsc#983234).

  - CVE-2016-5688: Various invalid memory reads in     ImageMagick WPG (bsc#985442).

  - CVE-2014-9834: Heap overflow in pict file (bsc#984436).

  - CVE-2014-9806: Prevent leak of file descriptor due to     corrupted file. (bsc#983774).

  - CVE-2016-5687: Out of bounds read in DDS coder     (bsc#985448).

  - CVE-2014-9838: Out of memory crash in magick/cache.c     (bsc#984370).

  - CVE-2014-9854: Filling memory during identification of     TIFF image (bsc#984184).

  - CVE-2015-8898: Prevent NULL pointer access in     magick/constitute.c (bsc#983746).

  - CVE-2014-9833: Heap overflow in psd file (bsc#984406).

  - CVE-2015-8894: Double free in coders/tga.c:221     (bsc#983523).

  - CVE-2015-8895: Integer and Buffer overflow in     coders/icon.c (bsc#983527).

  - CVE-2015-8896: Double free / integer truncation issue in     coders/pict.c:2000 (bsc#983533).

  - CVE-2015-8897: Out of bounds error in SpliceImage     (bsc#983739).

  - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451).

  - CVE-2016-5691: Checks for pixel.red/green/blue in dcm     coder (bsc#985456).

  - CVE-2014-9836: Crash in xpm file handling (bsc#984023).

  - CVE-2014-9808: SEGV due to corrupted dpc images.
    (bsc#983796).

  - CVE-2014-9821: Avoid heap overflow in pnm files.
    (bsc#984014).

  - CVE-2014-9820: Heap overflow in xpm files (bsc#984150).

  - CVE-2014-9823: Heap overflow in palm file (bsc#984401).

  - CVE-2014-9822: Heap overflow in quantum file     (bsc#984187).

  - CVE-2014-9825: Heap overflow in corrupted psd file     (bsc#984427).

  - CVE-2014-9824: Heap overflow in psd file (bsc#984185).

  - CVE-2014-9809: SEGV due to corrupted xwd images.
    (bsc#983799).

  - CVE-2014-9826: Incorrect error handling in sun files     (bsc#984186).

  - CVE-2014-9843: Incorrect boundary checks in     DecodePSDPixels (bsc#984179).

  - CVE-2014-9842: Memory leak in psd handling (bsc#984374).

  - CVE-2014-9841: Throwing of exceptions in psd handling     (bsc#984172).

  - CVE-2014-9840: Out of bound access in palm file     (bsc#984433).

  - CVE-2014-9847: Incorrect handling of 'previous' image in     the JNG decoder (bsc#984144).

  - CVE-2014-9846: Added checks to prevent overflow in rle     file. (bsc#983521).

  - CVE-2014-9845: Crash due to corrupted dib file     (bsc#984394).

  - CVE-2014-9844: Out of bound issue in rle file     (bsc#984373).

  - CVE-2014-9849: Crash in png coder (bsc#984018).

  - CVE-2014-9848: Memory leak in quantum management     (bsc#984404).

  - CVE-2014-9807: Double free in pdb coder. (bsc#983794).

  - CVE-2014-9829: Out of bound access in sun file     (bsc#984409).

  - CVE-2014-9832: Heap overflow in pcx file (bsc#984183).

  - CVE-2014-9805: SEGV due to a corrupted pnm file.
    (bsc#983752).

  - CVE-2016-4564: The DrawImage function in     MagickCore/draw.c in ImageMagick made an incorrect     function call in attempting to locate the next token,     which allowed remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     file (bsc#983308).

  - CVE-2016-4563: The TraceStrokePolygon function in     MagickCore/draw.c in ImageMagick mishandled the     relationship between the BezierQuantum value and certain     strokes data, which allowed remote attackers to cause a     denial of service (buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted file (bsc#983305).

  - CVE-2016-4562: The DrawDashPolygon function in     MagickCore/draw.c in ImageMagick mishandled calculations     of certain vertices integer data, which allowed remote     attackers to cause a denial of service (buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted file (bsc#983292).

  - CVE-2014-9839: Theoretical out of bound access in     magick/colormap-private.h (bsc#984379).

  - CVE-2016-5689: NULL ptr dereference in dcm coder     (bsc#985460).

  - CVE-2014-9837: Additional PNM sanity checks     (bsc#984166).

  - CVE-2014-9835: Heap overflow in wpf file (bsc#984145).

  - CVE-2014-9828: Corrupted (too many colors) psd file     (bsc#984028).

  - CVE-2016-5841: Integer overflow could have read to RCE     (bnc#986609).

  - CVE-2016-5842: Out-of-bounds read in     MagickCore/property.c:1396 could have lead to memory     leak (bnc#986608).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ImageMagick was updated to fix 55 security issues.

These security issues were fixed :

  - CVE-2014-9810: SEGV in dpx file handler (bsc#983803).

  - CVE-2014-9811: Crash in xwd file handler (bsc#984032).

  - CVE-2014-9812: NULL pointer dereference in ps file     handling (bsc#984137).

  - CVE-2014-9813: Crash on corrupted viff file     (bsc#984035).

  - CVE-2014-9814: NULL pointer dereference in wpg file     handling (bsc#984193).

  - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372).

  - CVE-2014-9816: Out of bound access in viff image     (bsc#984398).

  - CVE-2014-9817: Heap buffer overflow in pdb file handling     (bsc#984400).

  - CVE-2014-9818: Out of bound access on malformed sun file     (bsc#984181).

  - CVE-2014-9819: Heap overflow in palm files (bsc#984142).

  - CVE-2014-9830: Handling of corrupted sun file     (bsc#984135).

  - CVE-2014-9831: Handling of corrupted wpg file     (bsc#984375).

  - CVE-2014-9836: Crash in xpm file handling (bsc#984023).

  - CVE-2014-9851: Crash when parsing resource block     (bsc#984160).

  - CVE-2016-5689: NULL ptr dereference in dcm coder     (bsc#985460).

  - CVE-2014-9853: Memory leak in rle file handling     (bsc#984408).

  - CVE-2015-8902: PDB file DoS (CPU consumption)     (bsc#983253).

  - CVE-2015-8903: Denial of service (cpu) in vicar     (bsc#983259).

  - CVE-2015-8901: MIFF file DoS (endless loop)     (bsc#983234).

  - CVE-2014-9834: Heap overflow in pict file (bsc#984436).

  - CVE-2014-9806: Prevent file descriptr leak due to     corrupted file (bsc#983774).

  - CVE-2014-9838: Out of memory crash in magick/cache.c     (bsc#984370).

  - CVE-2014-9854: Filling memory during identification of     TIFF image (bsc#984184).

  - CVE-2015-8898: Prevent NULL pointer access in     magick/constitute.c (bsc#983746).

  - CVE-2015-8894: Double free in coders/tga.c:221     (bsc#983523).

  - CVE-2015-8896: Double free / integer truncation issue in     coders/pict.c:2000 (bsc#983533).

  - CVE-2015-8897: Out of bounds error in SpliceImage     (bsc#983739).

  - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451).

  - CVE-2016-5691: Checks for pixel.red/green/blue in dcm     coder (bsc#985456).

  - CVE-2014-9805: SEGV due to a corrupted pnm file.
    (bsc#983752).

  - CVE-2014-9808: SEGV due to corrupted dpc images.
    (bsc#983796).

  - CVE-2014-9820: heap overflow in xpm files (bsc#984150).

  - CVE-2014-9823: heap overflow in palm file (bsc#984401).

  - CVE-2014-9822: heap overflow in quantum file     (bsc#984187).

  - CVE-2014-9839: Theoretical out of bound access in     magick/colormap-private.h (bsc#984379).

  - CVE-2014-9824: Heap overflow in psd file (bsc#984185).

  - CVE-2014-9809: Fix a SEGV due to corrupted xwd images.
    (bsc#983799).

  - CVE-2014-9826: Incorrect error handling in sun files     (bsc#984186).

  - CVE-2014-9842: Memory leak in psd handling (bsc#984374).

  - CVE-2016-5687: Out of bounds read in DDS coder     (bsc#985448).

  - CVE-2014-9840: Out of bound access in palm file     (bsc#984433).

  - CVE-2014-9847: Incorrect handling of 'previous' image in     the JNG decoder (bsc#984144).

  - CVE-2014-9846: Added checks to prevent overflow in rle     file. (bsc#983521).

  - CVE-2014-9845: Crash due to corrupted dib file     (bsc#984394).

  - CVE-2014-9844: Out of bound issue in rle file     (bsc#984373).

  - CVE-2014-9849: Crash in png coder (bsc#984018).

  - CVE-2016-5688: Various invalid memory reads in     ImageMagick WPG (bsc#985442).

  - CVE-2014-9807: Fix a double free in pdb coder.
    (bsc#983794).

  - CVE-2014-9829: Out of bound access in sun file     (bsc#984409).

  - CVE-2016-4564: The DrawImage function in     MagickCore/draw.c in ImageMagick made an incorrect     function call in attempting to locate the next token,     which allowed remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     file (bsc#983308).

  - CVE-2016-4563: The TraceStrokePolygon function in     MagickCore/draw.c in ImageMagick mishandled the     relationship between the BezierQuantum value and certain     strokes data, which allowed remote attackers to cause a     denial of service (buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted file (bsc#983305).

  - CVE-2016-4562: The DrawDashPolygon function in     MagickCore/draw.c in ImageMagick mishandled calculations     of certain vertices integer data, which allowed remote     attackers to cause a denial of service (buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted file (bsc#983292).

  - CVE-2014-9837: Additional PNM sanity checks     (bsc#984166).

  - CVE-2014-9835: Heap overflow in wpf file (bsc#984145).

  - CVE-2014-9828: Corrupted (too many colors) psd file     (bsc#984028).

  - CVE-2016-5841: Integer overflow could have read to RCE     (bnc#986609).

  - CVE-2016-5842: Out-of-bounds read in     MagickCore/property.c:1396 could have lead to memory     leak (bnc#986608).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM, EXIF, RGF or BMP files are processed.

ImageMagick was updated to fix 66 security issues.

These security issues were fixed :

  - CVE-2014-9810: SEGV in dpx file handler. (bsc#983803).

  - CVE-2014-9811: Crash in xwd file handler (bsc#984032).

  - CVE-2014-9812: NULL pointer dereference in ps file     handling (bsc#984137).

  - CVE-2014-9813: Crash on corrupted viff file     (bsc#984035).

  - CVE-2014-9814: NULL pointer dereference in wpg file     handling (bsc#984193).

  - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372).

  - CVE-2014-9816: Out of bound access in viff image     (bsc#984398).

  - CVE-2014-9817: Heap buffer overflow in pdb file handling     (bsc#984400).

  - CVE-2014-9818: Out of bound access on malformed sun file     (bsc#984181).

  - CVE-2014-9819: Heap overflow in palm files (bsc#984142).

  - CVE-2014-9830: Handling of corrupted sun file     (bsc#984135).

  - CVE-2014-9831: Handling of corrupted wpg file     (bsc#984375).

  - CVE-2014-9850: Incorrect thread limit logic     (bsc#984149).

  - CVE-2014-9851: Crash when parsing resource block     (bsc#984160).

  - CVE-2014-9852: Incorrect usage of object after it has     been destroyed (bsc#984191).

  - CVE-2014-9853: Memory leak in rle file handling     (bsc#984408).

  - CVE-2015-8902: PDB file DoS (CPU consumption)     (bsc#983253).

  - CVE-2015-8903: Denial of service (cpu) in vicar     (bsc#983259).

  - CVE-2015-8900: HDR file DoS (endless loop) (bsc#983232).

  - CVE-2015-8901: MIFF file DoS (endless loop)     (bsc#983234).

  - CVE-2016-5688: Various invalid memory reads in     ImageMagick WPG (bsc#985442).

  - CVE-2014-9834: Heap overflow in pict file (bsc#984436).

  - CVE-2014-9806: Prevent leak of file descriptor due to     corrupted file. (bsc#983774).

  - CVE-2016-5687: Out of bounds read in DDS coder     (bsc#985448).

  - CVE-2014-9838: Out of memory crash in magick/cache.c     (bsc#984370).

  - CVE-2014-9854: Filling memory during identification of     TIFF image (bsc#984184).

  - CVE-2015-8898: Prevent NULL pointer access in     magick/constitute.c (bsc#983746).

  - CVE-2014-9833: Heap overflow in psd file (bsc#984406).

  - CVE-2015-8894: Double free in coders/tga.c:221     (bsc#983523).

  - CVE-2015-8895: Integer and Buffer overflow in     coders/icon.c (bsc#983527).

  - CVE-2015-8896: Double free / integer truncation issue in     coders/pict.c:2000 (bsc#983533).

  - CVE-2015-8897: Out of bounds error in SpliceImage     (bsc#983739).

  - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451).

  - CVE-2016-5691: Checks for pixel.red/green/blue in dcm     coder (bsc#985456).

  - CVE-2014-9836: Crash in xpm file handling (bsc#984023).

  - CVE-2014-9808: SEGV due to corrupted dpc images.
    (bsc#983796).

  - CVE-2014-9821: Avoid heap overflow in pnm files.
    (bsc#984014).

  - CVE-2014-9820: Heap overflow in xpm files (bsc#984150).

  - CVE-2014-9823: Heap overflow in palm file (bsc#984401).

  - CVE-2014-9822: Heap overflow in quantum file     (bsc#984187).

  - CVE-2014-9825: Heap overflow in corrupted psd file     (bsc#984427).

  - CVE-2014-9824: Heap overflow in psd file (bsc#984185).

  - CVE-2014-9809: SEGV due to corrupted xwd images.
    (bsc#983799).

  - CVE-2014-9826: Incorrect error handling in sun files     (bsc#984186).

  - CVE-2014-9843: Incorrect boundary checks in     DecodePSDPixels (bsc#984179).

  - CVE-2014-9842: Memory leak in psd handling (bsc#984374).

  - CVE-2014-9841: Throwing of exceptions in psd handling     (bsc#984172).

  - CVE-2014-9840: Out of bound access in palm file     (bsc#984433).

  - CVE-2014-9847: Incorrect handling of 'previous' image in     the JNG decoder (bsc#984144).

  - CVE-2014-9846: Added checks to prevent overflow in rle     file. (bsc#983521).

  - CVE-2014-9845: Crash due to corrupted dib file     (bsc#984394).

  - CVE-2014-9844: Out of bound issue in rle file     (bsc#984373).

  - CVE-2014-9849: Crash in png coder (bsc#984018).

  - CVE-2014-9848: Memory leak in quantum management     (bsc#984404).

  - CVE-2014-9807: Double free in pdb coder. (bsc#983794).

  - CVE-2014-9829: Out of bound access in sun file     (bsc#984409).

  - CVE-2014-9832: Heap overflow in pcx file (bsc#984183).

  - CVE-2014-9805: SEGV due to a corrupted pnm file.
    (bsc#983752).

  - CVE-2016-4564: The DrawImage function in     MagickCore/draw.c in ImageMagick made an incorrect     function call in attempting to locate the next token,     which allowed remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     file (bsc#983308).

  - CVE-2016-4563: The TraceStrokePolygon function in     MagickCore/draw.c in ImageMagick mishandled the     relationship between the BezierQuantum value and certain     strokes data, which allowed remote attackers to cause a     denial of service (buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted file (bsc#983305).

  - CVE-2016-4562: The DrawDashPolygon function in     MagickCore/draw.c in ImageMagick mishandled calculations     of certain vertices integer data, which allowed remote     attackers to cause a denial of service (buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted file (bsc#983292).

  - CVE-2014-9839: Theoretical out of bound access in     magick/colormap-private.h (bsc#984379).

  - CVE-2016-5689: NULL ptr dereference in dcm coder     (bsc#985460).

  - CVE-2014-9837: Additional PNM sanity checks     (bsc#984166).

  - CVE-2014-9835: Heap overflow in wpf file (bsc#984145).

  - CVE-2014-9828: Corrupted (too many colors) psd file     (bsc#984028).

  - CVE-2016-5841: Integer overflow could have read to RCE     (bnc#986609).

  - CVE-2016-5842: Out-of-bounds read in     MagickCore/property.c:1396 could have lead to memory     leak (bnc#986608).

This update was imported from the SUSE:SLE-12:Update update project.

ImageMagick was updated to fix 66 security issues.

These security issues were fixed :

  - CVE-2014-9810: SEGV in dpx file handler (bsc#983803).

  - CVE-2014-9811: Crash in xwd file handler (bsc#984032).

  - CVE-2014-9812: NULL pointer dereference in ps file     handling (bsc#984137).

  - CVE-2014-9813: Crash on corrupted viff file     (bsc#984035).

  - CVE-2014-9814: NULL pointer dereference in wpg file     handling (bsc#984193).

  - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372).

  - CVE-2014-9816: Out of bound access in viff image     (bsc#984398).

  - CVE-2014-9817: Heap buffer overflow in pdb file handling     (bsc#984400).

  - CVE-2014-9818: Out of bound access on malformed sun file     (bsc#984181).

  - CVE-2014-9819: Heap overflow in palm files (bsc#984142).

  - CVE-2014-9830: Handling of corrupted sun file     (bsc#984135).

  - CVE-2014-9831: Handling of corrupted wpg file     (bsc#984375).

  - CVE-2014-9850: Incorrect thread limit logic     (bsc#984149).

  - CVE-2014-9851: Crash when parsing resource block     (bsc#984160).

  - CVE-2014-9852: Incorrect usage of object after it has     been destroyed (bsc#984191).

  - CVE-2014-9853: Memory leak in rle file handling     (bsc#984408).

  - CVE-2015-8902: PDB file DoS (CPU consumption)     (bsc#983253).

  - CVE-2015-8903: Denial of service (cpu) in vicar     (bsc#983259).

  - CVE-2015-8900: HDR file DoS (endless loop) (bsc#983232).

  - CVE-2015-8901: MIFF file DoS (endless loop)     (bsc#983234).

  - CVE-2016-5688: Various invalid memory reads in     ImageMagick WPG (bsc#985442).

  - CVE-2014-9834: Heap overflow in pict file (bsc#984436).

  - CVE-2014-9806: Leaked file descriptor due to corrupted     file (bsc#983774).

  - CVE-2016-5687: Out of bounds read in DDS coder     (bsc#985448).

  - CVE-2014-9838: Out of memory crash in magick/cache.c     (bsc#984370).

  - CVE-2014-9854: Filling memory during identification of     TIFF image (bsc#984184).

  - CVE-2015-8898: Prevent NULL pointer access in     magick/constitute.c (bsc#983746).

  - CVE-2014-9833: Heap overflow in psd file (bsc#984406).

  - CVE-2015-8894: Double free in coders/tga.c:221     (bsc#983523).

  - CVE-2015-8895: Integer and Buffer overflow in     coders/icon.c (bsc#983527).

  - CVE-2015-8896: Double free / integer truncation issue in     coders/pict.c:2000 (bsc#983533).

  - CVE-2015-8897: Out of bounds error in SpliceImage     (bsc#983739).

  - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451).

  - CVE-2016-5691: Checks for pixel.red/green/blue in dcm     coder (bsc#985456).

  - CVE-2014-9836: Crash in xpm file handling (bsc#984023).

  - CVE-2014-9808: SEGV due to corrupted dpc images     (bsc#983796).

  - CVE-2014-9821: Avoid heap overflow in pnm files     (bsc#984014).

  - CVE-2014-9820: Heap overflow in xpm files (bsc#984150).

  - CVE-2014-9823: Heap overflow in palm file (bsc#984401).

  - CVE-2014-9822: Heap overflow in quantum file     (bsc#984187).

  - CVE-2014-9825: Heap overflow in corrupted psd file     (bsc#984427).

  - CVE-2014-9824: Heap overflow in psd file (bsc#984185).

  - CVE-2014-9809: SEGV due to corrupted xwd images     (bsc#983799).

  - CVE-2014-9826: Incorrect error handling in sun files     (bsc#984186).

  - CVE-2014-9843: Incorrect boundary checks in     DecodePSDPixels (bsc#984179).

  - CVE-2014-9842: Memory leak in psd handling (bsc#984374).

  - CVE-2014-9841: Throwing of exceptions in psd handling     (bsc#984172).

  - CVE-2014-9840: Out of bound access in palm file     (bsc#984433).

  - CVE-2014-9847: Incorrect handling of 'previous' image in     the JNG decoder (bsc#984144).

  - CVE-2014-9846: Added checks to prevent overflow in rle     file (bsc#983521).

  - CVE-2014-9845: Crash due to corrupted dib file     (bsc#984394).

  - CVE-2014-9844: Out of bound issue in rle file     (bsc#984373).

  - CVE-2014-9849: Crash in png coder (bsc#984018).

  - CVE-2014-9848: Memory leak in quantum management     (bsc#984404).

  - CVE-2014-9807: Double free in pdb coder (bsc#983794).

  - CVE-2014-9829: Out of bound access in sun file     (bsc#984409).

  - CVE-2014-9832: Heap overflow in pcx file (bsc#984183).

  - CVE-2014-9805: SEGV due to a corrupted pnm file     (bsc#983752).

  - CVE-2016-4564: The DrawImage function in     MagickCore/draw.c in ImageMagick made an incorrect     function call in attempting to locate the next token,     which allowed remote attackers to cause a denial of     service (buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     file (bsc#983308).

  - CVE-2016-4563: The TraceStrokePolygon function in     MagickCore/draw.c in ImageMagick mishandled the     relationship between the BezierQuantum value and certain     strokes data, which allowed remote attackers to cause a     denial of service (buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted file (bsc#983305).

  - CVE-2016-4562: The DrawDashPolygon function in     MagickCore/draw.c in ImageMagick mishandled calculations     of certain vertices integer data, which allowed remote     attackers to cause a denial of service (buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted file (bsc#983292).

  - CVE-2014-9839: Theoretical out of bound access in     magick/colormap-private.h (bsc#984379).

  - CVE-2016-5689: NULL ptr dereference in dcm coder     (bsc#985460).

  - CVE-2014-9837: Additional PNM sanity checks     (bsc#984166).

  - CVE-2014-9835: Heap overflow in wpf file (bsc#984145).

  - CVE-2014-9828: Corrupted (too many colors) psd file     (bsc#984028).

  - CVE-2016-5841: Out-of-bounds read in     MagickCore/property.c:1396 could lead to memory leak/     Integer overflow read to RCE (bnc#986609).

  - CVE-2016-5842: Out-of-bounds read in     MagickCore/property.c:1396 could lead to memory leak/     Integer overflow read to RCE (bnc#986608).

The version of ImageMagick installed on the remote Windows host is 6.x prior to 6.9.4-5 or 7.x prior to 7.0.1-7. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in the DCM     reader due to a NULL pointer dereference flaw that is     triggered during the handling of photometric     interpretation or the handling of frames. An     unauthenticated, remote attacker can exploit this to     crash processes linked against the library.
    (CVE-2016-5689)

  - A denial of service vulnerability exists in the DCM     reader due to improper computation of the pixel scaling     table. An unauthenticated, remote attacker can exploit     this to crash processes linked against the library.
    (CVE-2016-5690)

  - A denial of service vulnerability exists in the DCM     reader due to improper validation of pixel.red,     pixel,green, and pixel.blue. An unauthenticated, remote     attacker can exploit this to crash processes linked     against the library. (CVE-2016-5691)

  - Multiple denial of service vulnerabilities exist in     multiple functions in viff.c due to improper handling of     a saturation of exceptions. An unauthenticated, remote     attacker can exploit these issues to crash processes     linked against the library. (CVE-2016-10066,     CVE-2016-10067)

  - A denial of service vulnerability exists in the     ThrowReaderException() function in mat.c due to improper     handling of frame numbers in a crafted MAT file. An     unauthenticated, remote attacker can exploit this to     crash processes linked against the library.
    (CVE-2016-10069)

ID	Name	Product	Family	Severity
131846	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-2354)	Nessus	Huawei Local Security Checks	high
129127	EulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2019-1970)	Nessus	Huawei Local Security Checks	high
95053	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : imagemagick vulnerabilities (USN-3131-1)	Nessus	Ubuntu Local Security Checks	high
93179	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2016:1784-1)	Nessus	SuSE Local Security Checks	high
93178	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:1782-1)	Nessus	SuSE Local Security Checks	high
93115	Debian DSA-3652-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high
92487	openSUSE Security Update : ImageMagick (openSUSE-2016-883)	Nessus	SuSE Local Security Checks	high
91967	openSUSE Security Update : ImageMagick (openSUSE-2016-840)	Nessus	SuSE Local Security Checks	high
91819	ImageMagick 6.x < 6.9.4-5 / 7.x < 7.0.1-7 Multiple DoS	Nessus	Windows	high

CVE-2016-5690

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins