The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

Many security fixes, bug fixes, and other changes from the previous version 6.9.3.0. See the [6.9 branch ChangeLog](https://github.com/ImageMagick/ImageMagick/blob/3fd358e2ac3 4977fda38a2cf4d88a1cb4dd2d7c7/ChangeLog).

Dependent packages are mostly straight rebuilds, a couple also include bugfix version updates.

----

rhbz#1490649 - emacs-25.3 is available

rhbz#1490410 - unsafe enriched mode translations (security)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Many security fixes, bug fixes, and other changes from the previous version 6.9.3.0. See the [6.9 branch ChangeLog](https://github.com/ImageMagick/ImageMagick/blob/3fd358e2ac3 4977fda38a2cf4d88a1cb4dd2d7c7/ChangeLog).

Dependent packages are mostly straight rebuilds, a couple also include bugfix version updates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2016-9556 Possible Heap-overflow found by fuzzing     [bsc#1011130]

  - CVE-2016-9559 Possible NULL pointer access found by     fuzzing [bsc#1011136]

  - CVE-2016-8707 Possible code execution in Tiff conver     utility [bsc#1014159]

  - CVE-2016-8866 Memory allocation failure in     AcquireMagickMemory could lead to Heap overflow     [bsc#1009318]

  - CVE-2016-9559 Possible NULL pointer access found by     fuzzing [bsc#1011136]

This update was imported from the SUSE:SLE-12:Update update project.

This update for ImageMagick fixes the following issues :

  - CVE-2016-9556 Possible Heap-overflow found by fuzzing     [bsc#1011130]

  - CVE-2016-9559 Possible NULL pointer access found by     fuzzing [bsc#1011136]

  - CVE-2016-8707 Possible code execution in Tiff conver     utility [bsc#1014159]

  - CVE-2016-8866 Memory allocation failure in     AcquireMagickMemory could lead to Heap overflow     [bsc#1009318]

  - CVE-2016-9559 Possible NULL pointer access found by     fuzzing [bsc#1011136]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2016-9556: Possible Heap-overflow found by fuzzing     [bsc#1011130]

  - CVE-2016-9559: Possible NULL pointer access found by     fuzzing [bsc#1011136]

  - CVE-2016-8707: Possible code execution in the tiff     deflate convert code [bsc#1014159]

  - CVE-2016-9773: Possible Heap overflow in IsPixelGray     [bsc#1013376]

  - CVE-2016-8866: Possible memory allocation failure in     AcquireMagickMemory [bsc#1009318]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update for ImageMagick fixes the following issues :

  - a maliciously crafted compressed TIFF image could cause     code remote code execution in the convert utility in     particular circumstances (CVE-2016-8707, boo#1014159)

  - a memory allocation failure was fixed (CVE-2016-8866,     boo#1009318, follow up on CVE-2016-8862)

  - the identify utility could crash on maliciously crafted     images (CVE-2016-9773, boo#1013376, follow up on     CVE-2016-9556)

Numerous vulnerabilities were discovered in ImageMagick, an image manipulation program. Issues include memory exception, heap, buffer and stack overflows, out of bound reads and missing checks.

For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u10.

The exact impact of the vulnerabilities is unknown, as they were mostly discovered through fuzzing. We still recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of ImageMagick installed on the remote Windows host is 7.x prior to 7.0.3-9. It is, therefore, affected by a denial of service vulnerability due to an out-of-bounds read error in the ReadSGIImage() function within file coders/sgi.c when handling iris info dimensions.
An unauthenticated, remote attacker can exploit this to crash a process linked against the library or possibly disclose memory contents.

Note that CVE-2016-9773 exists due to an incomplete fix for CVE-2016-9556.

The version of ImageMagick installed on the remote Windows host is 6.x prior to 6.9.6-6. It is, therefore, affected by a denial of service vulnerability due to an out-of-bounds read error in the ReadSGIImage() function within file coders/sgi.c when handling iris info dimensions.
An unauthenticated, remote attacker can exploit this to crash a process linked against the library or possibly disclose memory contents.

This update for GraphicsMagick fixes the following issues :

  - a possible shell execution attack was fixed. if the     first character of an input filename for 'convert' was a     '|' then the remainder of the filename was passed to the     shell (CVE-2016-5118, boo#982178)

  - Maliciously crafted pnm files could crash GraphicsMagick     (CVE-2014-9805, [boo#983752])

  - Prevent overflow in rle files (CVE-2014-9846,     boo#983521)

  - Fix a double free in pdb coder (CVE-2014-9807,     boo#983794)

  - Fix a possible crash due to corrupted xwd images     (CVE-2014-9809, boo#983799)

  - Fix a possible crash due to corrupted wpg images     (CVE-2014-9815, boo#984372)

  - Fix a heap buffer overflow in pdb file handling     (CVE-2014-9817, boo#984400)

  - Fix a heap overflow in xpm files (CVE-2014-9820,     boo#984150)

  - Fix a heap overflow in pict files (CVE-2014-9834,     boo#984436)

  - Fix a heap overflow in wpf files (CVE-2014-9835,     CVE-2014-9831, boo#984145, boo#984375)

  - Additional PNM sanity checks (CVE-2014-9837, boo#984166)

  - Fix a possible crash due to corrupted dib file     (CVE-2014-9845, boo#984394)

  - Fix out of bound in quantum handling (CVE-2016-7529,     boo#1000399)

  - Fix out of bound access in xcf file coder     (CVE-2016-7528, boo#1000434)

  - Fix handling of corrupted lle files (CVE-2016-7515,     boo#1000689)

  - Fix out of bound access for malformed psd file     (CVE-2016-7522, boo#1000698)

  - Fix out of bound access for pbd files (CVE-2016-7531,     boo#1000704)

  - Fix out of bound access in corrupted wpg files     (CVE-2016-7533, boo#1000707)

  - Fix out of bound access in corrupted pdb files     (CVE-2016-7537, boo#1000711)

  - BMP Coder Out-Of-Bounds Write Vulnerability     (CVE-2016-6823, boo#1001066)

  - SGI Coder Out-Of-Bounds Read Vulnerability     (CVE-2016-7101, boo#1001221)

  - Divide by zero in WriteTIFFImage (do not divide by zero     in WriteTIFFImage, boo#1002206)

  - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders     (fix buffer overflow, boo#1002209)

  - 8BIM/8BIMW unsigned underflow leads to heap overflow     (CVE-2016-7800, boo#1002422)

  - wpg reader issues (CVE-2016-7996, CVE-2016-7997,     boo#1003629)

  - Mismatch between real filesize and header values     (CVE-2016-8684, boo#1005123)

  - Stack-buffer read overflow while reading SCT header     (CVE-2016-8682, boo#1005125)

  - Check that filesize is reasonable compared to the header     value (CVE-2016-8683, boo#1005127)

  - Memory allocation failure in AcquireMagickMemory     (CVE-2016-8862, boo#1007245)

  - heap-based buffer overflow in IsPixelGray     (CVE-2016-9556, boo#1011130)

This update for GraphicsMagick fixes the following security issues :

  - CVE-2016-9556: Maliciously crafted image headers could     cause denial of service in image format detection     routines (boo#1011130)

  - CVE-2016-9559: Maliciously crafted image headers could     cause denial of service in image format detection     routines for TIFF (boo#1011136)

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include several problems in memory handling that can result in a denial of service attack or in execution of arbitrary code by an attacker with control on the image input.

ID	Name	Product	Family	Severity
103333	Fedora 25 : 1:emacs / ImageMagick / WindowMaker / autotrace / converseen / etc (2017-3a568adb31)	Nessus	Fedora Local Security Checks	critical
103314	Fedora 26 : 1:emacs / ImageMagick / WindowMaker / autotrace / converseen / etc (2017-8f27031c8f)	Nessus	Fedora Local Security Checks	critical
96296	openSUSE Security Update : ImageMagick (openSUSE-2017-14)	Nessus	SuSE Local Security Checks	high
96139	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2016:3258-1)	Nessus	SuSE Local Security Checks	high
96138	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2016:3256-1)	Nessus	SuSE Local Security Checks	high
96133	openSUSE Security Update : ImageMagick (openSUSE-2016-1512)	Nessus	SuSE Local Security Checks	high
96051	Debian DLA-756-1 : imagemagick security update	Nessus	Debian Local Security Checks	high
95722	ImageMagick 7.x < 7.0.3-9 ReadSGIImage() SGI File Handling DoS	Nessus	Windows	medium
95720	ImageMagick 6.x < 6.9.6-6 ReadSGIImage() SGI File Handling DoS	Nessus	Windows	medium
95704	openSUSE Security Update : GraphicsMagick (openSUSE-2016-1430)	Nessus	SuSE Local Security Checks	critical
95595	openSUSE Security Update : GraphicsMagick (openSUSE-2016-1415)	Nessus	SuSE Local Security Checks	medium
95594	openSUSE Security Update : GraphicsMagick (openSUSE-2016-1414)	Nessus	SuSE Local Security Checks	medium
95593	openSUSE Security Update : ImageMagick (openSUSE-2016-1413)	Nessus	SuSE Local Security Checks	medium
95427	Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-3142-1)	Nessus	Ubuntu Local Security Checks	high
95362	Debian DSA-3726-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-9556

medium

Tenable Plugins

critical

critical

high

high

high

high

high

medium

medium

critical

medium

medium

medium

high

high