Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A divide-by-zero flaw was found in ImageMagick     6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an     attacker who submits a crafted file that is processed     by ImageMagick to trigger undefined behavior through a     division by zero. The highest threat from this     vulnerability is to system     availability.(CVE-2021-20176)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote     attackers to cause a denial of service (use-after-free     and application crash) or possibly have unspecified     other impact by crafting a Matlab image file that is     mishandled in ReadImage in     MagickCore/constitute.c.(CVE-2019-15140)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c,     as demonstrated by AcquireMagickMemory in     MagickCore/memory.c.(CVE-2019-16710)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c,     as demonstrated by XCreateImage.(CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in     magick/xwindow.c, related to     XCreateImage.(CVE-2019-16708)

  - ImageMagick 7.0.8-40 has a memory leak in     Huffman2DEncodeImage in coders/ps2.c.(CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c,     as demonstrated by PingImage in     MagickCore/constitute.c.(CVE-2019-16713)

  - In ImageMagick 7.0.5-7 Q16, an assertion failure was     found in the function LockSemaphoreInfo, which allows     attackers to cause a denial of service via a crafted     file.(CVE-2017-9501)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based     buffer overflow in the function WriteSGIImage of     coders/sgi.c.(CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based     buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile     and LocaleNCompare.(CVE-2019-19949)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before     6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to     cause a denial of service by sending a crafted     file.(CVE-2019-14981)

  - Null Pointer Dereference in the IdentifyImage function     in MagickCore/identify.c in ImageMagick through     7.0.6-10 allows an attacker to perform denial of     service by sending a crafted image     file.(CVE-2017-13768)

  - The XWD image (X Window System window dumping file)     parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application     crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted     XWD image file, a different vulnerability than     CVE-2019-11472.(CVE-2019-15139)

  - When ImageMagick 7.0.6-1 processes a crafted file in     convert, it can lead to a heap-based buffer over-read     in the WriteUILImage() function in     coders/uil.c.(CVE-2017-11533)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote     attackers to cause a denial of service (use-after-free     and application crash) or possibly have unspecified     other impact by crafting a Matlab image file that is     mishandled in ReadImage in     MagickCore/constitute.c.(CVE-2019-15140)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before     6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to     cause a denial of service by sending a crafted     file.(CVE-2019-14981)

  - ImageMagick 7.0.8-35 has a memory leak in     magick/xwindow.c, related to     XCreateImage.(CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c,     as demonstrated by XCreateImage.(CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c,     as demonstrated by AcquireMagickMemory in     MagickCore/memory.c.(CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in     Huffman2DEncodeImage in coders/ps2.c.(CVE-2019-16711)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based     buffer overflow in the function WriteSGIImage of     coders/sgi.c.(CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based     buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile     and LocaleNCompare.(CVE-2019-19949)

  - ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based     buffer over-read in BlobToStringInfo in     MagickCore/string.c during TIFF image     decoding.(CVE-2020-13902)

  - In ImageMagick 7.0.5-7 Q16, an assertion failure was     found in the function LockSemaphoreInfo, which allows     attackers to cause a denial of service via a crafted     file.(CVE-2017-9501)

  - When ImageMagick 7.0.6-1 processes a crafted file in     convert, it can lead to a heap-based buffer over-read     in the WriteUILImage() function in     coders/uil.c.(CVE-2017-11533)

  - Null Pointer Dereference in the IdentifyImage function     in MagickCore/identify.c in ImageMagick through     7.0.6-10 allows an attacker to perform denial of     service by sending a crafted image     file.(CVE-2017-13768)

  - ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40     mishandles the -authenticate option, which allows     setting a password for password-protected PDF files.
    The user-controlled password was not properly     escaped/sanitized and it was therefore possible to     inject additional shell commands via     coders/pdf.c.(CVE-2020-29599)

  - A flaw was found in ImageMagick in     MagickCore/statistic.c. An attacker who submits a     crafted file that is processed by ImageMagick could     trigger undefined behavior in the form of values     outside the range of type `unsigned long`. This would     most likely lead to an impact to application     availability, but could potentially cause other     problems related to undefined behavior. This flaw     affects ImageMagick versions prior to     7.0.8-69.(CVE-2020-27766)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When ImageMagick 7.0.6-1 processes a crafted file in     convert, it can lead to a heap-based buffer over-read     in the WriteUILImage() function in     coders/uil.c.(CVE-2017-11533)

  - Null Pointer Dereference in the IdentifyImage function     in MagickCore/identify.c in ImageMagick through     7.0.6-10 allows an attacker to perform denial of     service by sending a crafted image     file.(CVE-2017-13768)

  - In ImageMagick 7.0.5-7 Q16, an assertion failure was     found in the function LockSemaphoreInfo, which allows     attackers to cause a denial of service via a crafted     file.(CVE-2017-9501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Debian Bug : 870020 870019 876105 869727 886281 873059 870504 870530 870107 872609 875338 875339 875341 873871 873131 875352 878506 875503 875502 876105 876099 878546 878545 877354 877355 878524 878547 878548 878555 878554 878548 878555 878554 878579 885942 886584 928206 941670 931447 932079

Several security vulnerabilities were found in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u10.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Numerous security vulnerabilities were fixed in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 8 'Jessie', these problems have been fixed in version 8:6.8.9.9-5+deb8u16.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues.

These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348). This     update was imported from the SUSE:SLE-12:Update update     project.

This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011)

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087)

  - CVE-2017-18219: Prevent allocation failure in the     function ReadOnePNGImage, which allowed attackers to     cause a denial of service via a crafted file that     triggers an attempt at a large png_pixels array     allocation (bsc#1084060).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290)

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170)

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168)

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630)

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434)

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735)

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792)

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291)

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283)

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362)

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

6.9.9-15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-07 (ImageMagick: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ImageMagick. Please       review the referenced CVE identifiers for details.
  Impact :

    Remote attackers, by enticing a user to process a specially crafted       file, could obtain sensitive information, cause a Denial of Service       condition, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

6.9.9-15

----

Rebuilt for ImageMagick 6.9.9-13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates fixes numerous vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure, or the execution of arbitrary code if malformed XCF, VIFF, BMP, thumbnail, CUT, PSD, TXT, XBM, PCX, MPC, WPG, TIFF, SVG, font, EMF, PNG, or other types of files are processed.

For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u17.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
149134	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2021-1802)	Nessus	Huawei Local Security Checks	critical
146668	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2021-1305)	Nessus	Huawei Local Security Checks	critical
146167	EulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2021-1195)	Nessus	Huawei Local Security Checks	medium
140297	Debian DLA-2366-1 : imagemagick security update	Nessus	Debian Local Security Checks	critical
125093	Debian DLA-1785-1 : imagemagick security update	Nessus	Debian Local Security Checks	critical
110516	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ImageMagick vulnerabilities (USN-3681-1)	Nessus	Ubuntu Local Security Checks	critical
108935	openSUSE Security Update : ImageMagick (openSUSE-2018-343)	Nessus	SuSE Local Security Checks	critical
108877	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:0880-1)	Nessus	SuSE Local Security Checks	high
108824	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0857-1)	Nessus	SuSE Local Security Checks	critical
106007	Fedora 27 : 1:ImageMagick / rubygem-rmagick (2017-f5a9805c5b)	Nessus	Fedora Local Security Checks	medium
104515	GLSA-201711-07 : ImageMagick: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103901	Fedora 26 : ImageMagick / rubygem-rmagick (2017-897a192750)	Nessus	Fedora Local Security Checks	medium
103898	Fedora 25 : ImageMagick / rubygem-rmagick (2017-66d9113c7a)	Nessus	Fedora Local Security Checks	medium
103756	Debian DLA-1131-1 : imagemagick security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-13768

medium

Tenable Plugins

critical

critical

medium

critical

critical

critical

critical

high

critical

medium

critical

medium

medium

high