The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote
    attackers to have unspecified impact via a colormap with a large number of entries. (CVE-2016-7996)

  - Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows
    remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers
    a heap-based buffer overflow. (CVE-2016-7800)

  - The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of
    service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
    (CVE-2016-7997)

  - The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a
    denial of service (out-of-bounds read) via a crafted SCT header. (CVE-2016-8682)

GraphicsMagick reports :

Multiple vulnerabilities have been found in GraphicsMagick 1.3.26 or earlier. Please refer to the CVE list for details.

The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.(CVE-2017-6335)

The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.(CVE-2016-7997)

Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries. (CVE-2016-7996 )

The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a 'file truncation error for corrupt file.' (CVE-2016-8684)

The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header. (CVE-2016-8682)

The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a 'file truncation error for corrupt file.' (CVE-2016-8683)

The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image. (CVE-2016-9830)

Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow. (CVE-2016-7800 )

This security update for GraphicsMagick fixes the following issues :

  - a memory allocation failure was fixed (CVE-2016-8866,     boo#1009318)

  - maliciously crafted jng files could crash the identify     utility (CVE-2016-9830, boo#1013640)

Several vulnerabilities have been discovered in GraphicsMagick, a collection of image processing tool, which can cause denial of service attacks, remote file deletion, and remote command execution.

This security update removes the full support of PLT/Gnuplot decoder to prevent Gnuplot-shell based shell exploits for fixing the CVE-2016-3714 vulnerability.

The undocumented 'TMP' magick prefix no longer removes the argument file after it has been read for fixing the CVE-2016-3715 vulnerability. Since the 'TMP' feature was originally implemented, GraphicsMagick added a temporary file management subsystem which assures that temporary files are removed so this feature is not needed.

Remove support for reading input from a shell command, or writing output to a shell command, by prefixing the specified filename (containing the command) with a '|' for fixing the CVE-2016-5118 vulnerability.

  - CVE-2015-8808     Gustavo Grieco discovered an out of bound read in the     parsing of GIF files which may cause denial of service.

  - CVE-2016-2317     Gustavo Grieco discovered a stack-based buffer overflow     and two heap buffer overflows while processing SVG     images which may cause denial of service.

  - CVE-2016-2318     Gustavo Grieco discovered several segmentation faults     while processing SVG images which may cause denial of     service.

  - CVE-2016-5240     Gustavo Grieco discovered an endless loop problem caused     by negative stroke-dasharray arguments while parsing SVG     files which may cause denial of service.

  - CVE-2016-7800     Marco Grassi discovered an unsigned underflow leading to     heap overflow when parsing 8BIM chunk often attached to     JPG files which may cause denial of service.

  - CVE-2016-7996     Moshe Kaplan discovered that there is no check that the     provided colormap is not larger than 256 entries in the     WPG reader which may cause denial of service.

  - CVE-2016-7997     Moshe Kaplan discovered that an assertion is thrown for     some files in the WPG reader due to a logic error which     may cause denial of service.

  - CVE-2016-8682     Agostino Sarubbo of Gentoo discovered a stack buffer     read overflow while reading the SCT header which may     cause denial of service.

  - CVE-2016-8683     Agostino Sarubbo of Gentoo discovered a memory     allocation failure in the PCX coder which may cause     denial of service.

  - CVE-2016-8684     Agostino Sarubbo of Gentoo discovered a memory     allocation failure in the SGI coder which may cause     denial of service.

  - CVE-2016-9830     Agostino Sarubbo of Gentoo discovered a memory     allocation failure in MagickRealloc() function which may     cause denial of service.

ID	Name	Product	Family	Severity
426599	Alpine: multiple graphicsmagick packages: security update to 1.3.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426599	Alpine: multiple graphicsmagick packages: security update to 1.3.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404813	Alpine: multiple graphicsmagick packages: security update to 1.3.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404813	Alpine: multiple graphicsmagick packages: security update to 1.3.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
110628	FreeBSD : GraphicsMagick -- multiple vulnerabilities (25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba)	Nessus	FreeBSD Local Security Checks	critical
99533	Amazon Linux AMI : GraphicsMagick (ALAS-2017-820)	Nessus	Amazon Linux Local Security Checks	critical
96132	openSUSE Security Update : GraphicsMagick (openSUSE-2016-1511)	Nessus	SuSE Local Security Checks	high
96103	Debian DSA-3746-1 : graphicsmagick - security update (ImageTragick)	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-9830

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical