http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78

[debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update

https://sourceforge.net/p/graphicsmagick/bugs/448/

DSA-4321

Several vulnerabilities have been discovered in GraphicsMagick, a set of command-line applications to manipulate image files, which could result in denial of service or the execution of arbitrary code if malformed image files are processed.

Various security issues were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer overflows or overreads may lead to a denial of service or disclosure of in-memory information or other unspecified impact by processing a malformed image file.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.20-3+deb8u3.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues.

These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348). This     update was imported from the SUSE:SLE-12:Update update     project.

This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011)

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087)

  - CVE-2017-18219: Prevent allocation failure in the     function ReadOnePNGImage, which allowed attackers to     cause a denial of service via a crafted file that     triggers an attempt at a large png_pixels array     allocation (bsc#1084060).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290)

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170)

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168)

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630)

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434)

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735)

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792)

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291)

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283)

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362)

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for GraphicsMagick fixes the following issues :

  - CVE-2017-18230: Specially crafted CINEON images may have     caused a NULL pointer dereference (boo#1085233)

  - CVE-2017-16353: Specially crafted MIFF images could have     allowed for information disclosure (boo#1066170)

  - CVE-2017-16352: Specially crafted MIFF images may have     caused a heap-based buffer overflow (boo#1066168)

  - CVE-2017-14314: Specially crafted image files may have     caused a denial of service (boo#1058630)

  - CVE-2017-14505: Specially crafted image files may have     caused a NULL pointer dereference (boo#1059735)

  - CVE-2017-15016: Specially crafted EMF images may have     caused a NULL pointer dereference (boo#1082291)

  - CVE-2017-15017: Specially crafted MSG images may have     caused a NULL pointer dereference (boo#1082283)

  - CVE-2017-18219: Specially crafted image files may have     been used to cause an application crash (boo#1084060)

  - CVE-2017-18220: Specially crafted PNG images may have     been used to cause a denial of service (boo#1084062)

Multiple vulnerabilities were found in graphicsmagick.

CVE-2017-14103

The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403.

CVE-2017-14314

Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file.

CVE-2017-14504

ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format, leading to a NULL pointer Dereference.

CVE-2017-14733

ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

CVE-2017-14994

ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image, related to the ability of DCM_ReadNonNativeImages to yield an image list with zero frames.

CVE-2017-14997

GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c.

CVE-2017-15930

In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a NULL pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer.

For Debian 7 'Wheezy', CVE-2017-15930 has been fixed in version 1.3.16-1.1+deb7u12. The other security issues were fixed in 1.3.16-1.1+deb7u10 on 10 Oct 2017 in DLA-1130-1 but that announcement was never sent out so this advisory also contains the notice about those vulnerabilities.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
118179	Debian DSA-4321-1 : graphicsmagick - security update	Nessus	Debian Local Security Checks	high
110727	Debian DLA-1401-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	high
108935	openSUSE Security Update : ImageMagick (openSUSE-2018-343)	Nessus	SuSE Local Security Checks	high
108877	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:0880-1)	Nessus	SuSE Local Security Checks	high
108824	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0857-1)	Nessus	SuSE Local Security Checks	high
108447	openSUSE Security Update : GraphicsMagick (openSUSE-2018-283)	Nessus	SuSE Local Security Checks	medium
104336	Debian DLA-1154-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	high

CVE-2017-14314

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins