In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in     coders/webp.c. (CVE-2018-9135)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in
    MagickCore/property.c. (CVE-2018-16329)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
    (CVE-2018-5246)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. (CVE-2018-5247)

  - ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c. (CVE-2018-5357)

  - ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as
    demonstrated by the ReadPSDLayersInternal function in coders/psd.c. (CVE-2018-5358)

This update for ImageMagick fixes the following issues :

  - CVE-2017-14325: In ImageMagick, a memory leak     vulnerability was found in the function     PersistPixelCache in magick/cache.c, which allowed     attackers to cause a denial of service (memory     consumption in ReadMPCImage in coders/mpc.c) via a     crafted file. [bsc#1058635]

  - CVE-2017-17887: In ImageMagick, a memory leak     vulnerability was found in the function     GetImagePixelCache in magick/cache.c, which allowed     attackers to cause a denial of service via a crafted MNG     image file that is processed by ReadOneMNGImage.
    [bsc#1074117]

  - CVE-2017-18250: A NULL pointer dereference vulnerability     was found in the function LogOpenCLBuildFailure in     MagickCore/opencl.c, which could lead to a denial of     service via a crafted file. [bsc#1087039]

  - CVE-2017-18251: A memory leak vulnerability was found in     the function ReadPCDImage in coders/pcd.c, which could     lead to a denial of service via a crafted file.
    [bsc#1087037]

  - CVE-2017-18252: The MogrifyImageList function in     MagickWand/mogrify.c could allow attackers to cause a     denial of service via a crafted file. [bsc#1087033]

  - CVE-2017-18254: A memory leak vulnerability was found in     the function WriteGIFImage in coders/gif.c, which could     lead to denial of service via a crafted file.
    [bsc#1087027]

  - CVE-2018-8960: The ReadTIFFImage function in     coders/tiff.c in ImageMagick did not properly restrict     memory allocation, leading to a heap-based buffer     over-read. [bsc#1086782]

  - CVE-2018-9018: divide-by-zero in the ReadMNGImage     function of coders/png.c. Attackers could leverage this     vulnerability to cause a crash and denial of service via     a crafted mng file. [bsc#1086773]

  - CVE-2018-9135: heap-based buffer over-read in     IsWEBPImageLossless in coders/webp.c could lead to     denial of service. [bsc#1087825]

  - CVE-2018-10177: In ImageMagick, there was an infinite     loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability     to cause a denial of service via a crafted mng file.
    [bsc#1089781]

  - CVE-2017-10928: a heap-based buffer over-read in the     GetNextToken function in token.c could allow attackers     to obtain sensitive information from process memory or     possibly have unspecified other impact via a crafted SVG     document that is mishandled in the     GetUserSpaceCoordinateValue function in coders/svg.c.
    [bsc#1047356]

This update was imported from the SUSE:SLE-12:Update update project.

This update for ImageMagick fixes the following issues :

  - CVE-2017-14325: In ImageMagick, a memory leak     vulnerability was found in the function     PersistPixelCache in magick/cache.c, which allowed     attackers to cause a denial of service (memory     consumption in ReadMPCImage in coders/mpc.c) via a     crafted file. [bsc#1058635]

  - CVE-2017-17887: In ImageMagick, a memory leak     vulnerability was found in the function     GetImagePixelCache in magick/cache.c, which allowed     attackers to cause a denial of service via a crafted MNG     image file that is processed by ReadOneMNGImage.
    [bsc#1074117]

  - CVE-2017-18250: A NULL pointer dereference vulnerability     was found in the function LogOpenCLBuildFailure in     MagickCore/opencl.c, which could lead to a denial of     service via a crafted file. [bsc#1087039]

  - CVE-2017-18251: A memory leak vulnerability was found in     the function ReadPCDImage in coders/pcd.c, which could     lead to a denial of service via a crafted file.
    [bsc#1087037]

  - CVE-2017-18252: The MogrifyImageList function in     MagickWand/mogrify.c could allow attackers to cause a     denial of service via a crafted file. [bsc#1087033]

  - CVE-2017-18254: A memory leak vulnerability was found in     the function WriteGIFImage in coders/gif.c, which could     lead to denial of service via a crafted file.
    [bsc#1087027]

  - CVE-2018-8960: The ReadTIFFImage function in     coders/tiff.c in ImageMagick did not properly restrict     memory allocation, leading to a heap-based buffer     over-read. [bsc#1086782]

  - CVE-2018-9018: divide-by-zero in the ReadMNGImage     function of coders/png.c. Attackers could leverage this     vulnerability to cause a crash and denial of service via     a crafted mng file. [bsc#1086773]

  - CVE-2018-9135: heap-based buffer over-read in     IsWEBPImageLossless in coders/webp.c could lead to     denial of service. [bsc#1087825]

  - CVE-2018-10177: In ImageMagick, there was an infinite     loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability     to cause a denial of service via a crafted mng file.
    [bsc#1089781]

  - CVE-2017-10928: a heap-based buffer over-read in the     GetNextToken function in token.c could allow attackers     to obtain sensitive information from process memory or     possibly have unspecified other impact via a crafted SVG     document that is mishandled in the     GetUserSpaceCoordinateValue function in coders/svg.c.
    [bsc#1047356]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
222667	Linux Distros Unpatched Vulnerability : CVE-2018-9135	Nessus	Misc.	high
404969	Alpine: imagemagick6: security update to 6.9.10.39-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404969	Alpine: imagemagick6: security update to 6.9.10.39-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404968	Alpine: imagemagick6: security update to 6.9.10.37-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404968	Alpine: imagemagick6: security update to 6.9.10.37-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
109715	openSUSE Security Update : ImageMagick (openSUSE-2018-442)	Nessus	SuSE Local Security Checks	high
109673	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:1178-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-9135

high

Tenable Plugins

high

critical

critical

critical

critical

high

high