openSUSE-SU-2019:1983

https://github.com/ImageMagick/ImageMagick/commit/e92040ea6ee2a844ebfd2344174076795a4787bd

https://github.com/ImageMagick/ImageMagick/issues/1612

https://github.com/ImageMagick/ImageMagick6/commit/cb5ec7d98195aa74d5ed299b38eff2a68122f3fa

[debian-lts-announce] 20190816 [SECURITY] [DLA 1888-1] imagemagick security update

USN-4192-1

DSA-4715

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ImageMagick packages installed that are affected by multiple vulnerabilities:

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ImageMagick packages installed that are affected by multiple vulnerabilities:

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadBMPImage in     coders/bmp.c.(CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadVIFFImage in     coders/viff.c.(CVE-2019-13134)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in     the WriteDPXImage function in     coders/dpx.c.(CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadPSImage in     coders/ps.c.(CVE-2019-13137)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in     AcquireMagickMemory because of an AnnotateImage     error.(CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in     RemoveDuplicateLayers in     MagickCore/layer.c.(CVE-2019-13454)

  - ImageMagick version 7.0.7-28 contains a memory leak in     ReadYCBCRImage in coders/ycbcr.c.(CVE-2018-10805)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1497 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick version 7.0.7-28 contains a memory leak in     ReadYCBCRImage in coders/ycbcr.c.(CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in     the WriteDPXImage function in     coders/dpx.c.(CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadPSImage in     coders/ps.c.(CVE-2019-13137)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in     AcquireMagickMemory because of an AnnotateImage     error.(CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in     RemoveDuplicateLayers in     MagickCore/layer.c.(CVE-2019-13454)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WriteDIBImage in coders/dib.c.(CVE-2019-7398)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. (CVE-2017-18254)

An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file. (CVE-2017-18252)

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. (CVE-2017-18251)

In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file. (CVE-2018-16749)

ImageMagick 7.0.8-34 has a 'use of uninitialized value' vulnerability in the ReadPANGOImage function in coders/pango.c. (CVE-2019-12978)

The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file. (CVE-2017-11166)

In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c. (CVE-2018-13153)

ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c.
(CVE-2018-14435)

ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c.
(CVE-2018-14437)

ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. (CVE-2019-13311)

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. (CVE-2019-17540)

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
(CVE-2019-14980)

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. (CVE-2019-14981)

In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
(CVE-2019-9956)

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
(CVE-2019-7397)

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
(CVE-2019-11597)

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. (CVE-2019-15140)

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. (CVE-2017-12806)

In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. (CVE-2019-10650)

ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c. (CVE-2019-13133)

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. (CVE-2019-13134)

ImageMagick before 7.0.8-50 has a 'use of uninitialized value' vulnerability in the function ReadCUTImage in coders/cut.c.
(CVE-2019-13135)

In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. (CVE-2019-13310)

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file. (CVE-2017-18271)

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. (CVE-2019-16713)

ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image. (CVE-2019-16712)

ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
(CVE-2019-16710)

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. (CVE-2019-11472)

ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. (CVE-2019-12975)

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file. (CVE-2019-11470)

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. (CVE-2019-10131)

WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file. (CVE-2018-8804)

ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. (CVE-2018-16328)

ImageMagick 7.0.8-34 has a 'use of uninitialized value' vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. (CVE-2019-13454)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. (CVE-2019-19948)

In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
(CVE-2018-11656)

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-20467)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
(CVE-2019-13307)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
(CVE-2019-13306)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. (CVE-2019-13305)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
(CVE-2019-13304)

ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. (CVE-2019-13301)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. (CVE-2019-13300)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. (CVE-2019-11597)

In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. (CVE-2018-12599)

A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image. (CVE-2019-12974)

In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
(CVE-2018-16750)

ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. (CVE-2018-10177)

In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. (CVE-2018-12600)

This update fixes multiple vulnerabilities in Imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed image files are processed.

* ImageMagick: multiple security vulnerabilities

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory.

  - ImageMagick: CPU exhaustion vulnerability in function     ReadDDSInfo in coders/dds.c (CVE-2017-1000476)

  - ImageMagick: memory leak vulnerability in ReadXWDImage     function in coders/xwd.c (CVE-2017-11166)

  - ImageMagick: memory exhaustion in function ReadTIFFImage     causing denial of service (CVE-2017-12805)

  - ImageMagick: memory exhaustion in function format8BIM     causing denial of service (CVE-2017-12806)

  - ImageMagick: memory leak in ReadPCDImage function in     coders/pcd.c (CVE-2017-18251)

  - ImageMagick: assertion failure in MogrifyImageList     function in MagickWand/mogrify.c (CVE-2017-18252)

  - ImageMagick: memory leak in WriteGIFImage function in     coders/gif.c (CVE-2017-18254)

  - ImageMagick: infinite loop in ReadMIFFImage function in     coders/miff.c (CVE-2017-18271)

  - ImageMagick: infinite loop ReadTXTImage  in function in     coders/txt.c (CVE-2017-18273)

  - ImageMagick: Infinite loop in     coders/png.c:ReadOneMNGImage() allows attackers to cause     a denial of service via crafted MNG file     (CVE-2018-10177)

  - ImageMagick: Memory leak in WriteTIFFImage     (CVE-2018-10804)

  - ImageMagick: Memory leak in ReadYCBCRImage     (CVE-2018-10805)

  - ImageMagick: memory leak in ReadDCMImage function in     coders/dcm.c (CVE-2018-11656)

  - ImageMagick: out of bounds write in ReadBMPImage and     WriteBMPImage in coders/bmp.c (CVE-2018-12599)

  - ImageMagick: out of bounds write ReadDIBImage and     WriteDIBImage in coders/dib.c (CVE-2018-12600)

  - ImageMagick: memory leak in the XMagickCommand function     in MagickCore/animate.c (CVE-2018-13153)

  - ImageMagick: memory leak for a colormap in WriteMPCImage     in coders/mpc.c (CVE-2018-14434)

  - ImageMagick: memory leak in DecodeImage in coders/pcd.c     (CVE-2018-14435)

  - ImageMagick: memory leak in ReadMIFFImage in     coders/miff.c (CVE-2018-14436)

  - ImageMagick: memory leak in parse8BIM in coders/meta.c     (CVE-2018-14437)

  - ImageMagick: CPU Exhaustion via crafted input file     (CVE-2018-15607)

  - ImageMagick: NULL pointer dereference in     CheckEventLogging function in MagickCore/log.c     (CVE-2018-16328)

  - ImageMagick: reachable assertion in ReadOneJNGImage in     coders/png.c (CVE-2018-16749)

  - ImageMagick: Memory leak in the formatIPTCfromBuffer     function in coders/meta.c (CVE-2018-16750)

  - ImageMagick: memory leak in WriteMSLImage of     coders/msl.c (CVE-2018-18544)

  - ImageMagick: infinite loop in coders/bmp.c     (CVE-2018-20467)

  - ImageMagick: double free in WriteEPTImage function in     coders/ept.c (CVE-2018-8804)

  - ImageMagick: excessive iteration in the DecodeLabImage     and EncodeLabImage functions in coders/tiff.c     (CVE-2018-9133)

  - ImageMagick: off-by-one read in formatIPTCfromBuffer     function in coders/meta.c (CVE-2019-10131)

  - ImageMagick: heap-based buffer over-read in     WriteTIFFImage of coders/tiff.c leads to denial of     service or information disclosure via crafted image file     (CVE-2019-10650)

  - ImageMagick: denial of service in cineon parsing     component (CVE-2019-11470)

  - ImageMagick: denial of service in ReadXWDImage in     coders/xwd.c in the XWD image parsing component     (CVE-2019-11472)

  - ImageMagick: heap-based buffer over-read in the function     WriteTIFFImage of coders/tiff.c leading to DoS or     information disclosure (CVE-2019-11597)

  - ImageMagick: heap-based buffer over-read in the function     WritePNMImage of coders/pnm.c leading to DoS or     information disclosure (CVE-2019-11598)

  - imagemagick: null-pointer dereference in function     ReadPANGOImage in coders/pango.c and ReadVIDImage in     coders/vid.c causing denial of service (CVE-2019-12974)

  - imagemagick: memory leak vulnerability in function     WriteDPXImage in coders/dpx.c (CVE-2019-12975)

  - imagemagick: memory leak vulnerability in function     ReadPCLImage in coders/pcl.c (CVE-2019-12976)

  - imagemagick: use of uninitialized value in function     ReadPANGOImage in coders/pango.c (CVE-2019-12978)

  - imagemagick: use of uninitialized value in     functionSyncImageSettings in MagickCore/image.c     (CVE-2019-12979)

  - ImageMagick: a memory leak vulnerability in the function     ReadBMPImage in coders/bmp.c (CVE-2019-13133)

  - ImageMagick: a memory leak vulnerability in the function     ReadVIFFImage in coders/viff.c (CVE-2019-13134)

  - ImageMagick: a use of uninitialized value     vulnerability in the function ReadCUTImage leading to a     crash and DoS (CVE-2019-13135)

  - ImageMagick: heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage because     a width of zero is mishandled (CVE-2019-13295)

  - ImageMagick: heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage because     a height of zero is mishandled (CVE-2019-13297)

  - ImageMagick: heap-based buffer overflow at     MagickCore/statistic.c in EvaluateImages because of     mishandling columns (CVE-2019-13300)

  - ImageMagick: memory leaks in AcquireMagickMemory     (CVE-2019-13301)

  - ImageMagick: stack-based buffer overflow at coders/pnm.c     in WritePNMImage because of a misplaced assignment     (CVE-2019-13304)

  - ImageMagick: stack-based buffer overflow at coders/pnm.c     in WritePNMImage because of a misplaced strncpy and an     off-by-one error (CVE-2019-13305)

  - ImageMagick: stack-based buffer overflow at coders/pnm.c     in WritePNMImage because of off-by-one errors     (CVE-2019-13306)

  - ImageMagick: heap-based buffer overflow at     MagickCore/statistic.c in EvaluateImages because of     mishandling rows (CVE-2019-13307)

  - ImageMagick: memory leaks at AcquireMagickMemory due to     mishandling the NoSuchImage error in     CLIListOperatorImages (CVE-2019-13309)

  - ImageMagick: memory leaks at AcquireMagickMemory because     of an error in MagickWand/mogrify.c (CVE-2019-13310)

  - ImageMagick: memory leaks at AcquireMagickMemory because     of a wand/mogrify.c error (CVE-2019-13311)

  - ImageMagick: division by zero in RemoveDuplicateLayers     in MagickCore/layer.c (CVE-2019-13454)

  - ImageMagick: use-after-free in magick/blob.c resulting     in a denial of service (CVE-2019-14980)

  - ImageMagick: division by zero in MeanShiftImage in     MagickCore/feature.c (CVE-2019-14981)

  - ImageMagick: out-of-bounds read in ReadXWDImage in     coders/xwd.c (CVE-2019-15139)

  - ImageMagick: Use after free in ReadMATImage in     coders/mat.c (CVE-2019-15140)

  - ImageMagick: heap-based buffer overflow in     WriteTIFFImage in coders/tiff.c (CVE-2019-15141)

  - ImageMagick: memory leak in magick/xwindow.c     (CVE-2019-16708)

  - ImageMagick: memory leak in coders/dps.c     (CVE-2019-16709)

  - ImageMagick: memory leak in coders/dot.c     (CVE-2019-16710, CVE-2019-16713)

  - ImageMagick: memory leak in Huffman2DEncodeImage in     coders/ps2.c (CVE-2019-16711)

  - ImageMagick: memory leak in Huffman2DEncodeImage in     coders/ps3.c (CVE-2019-16712)

  - ImageMagick: heap-based buffer overflow in ReadPSInfo in     coders/ps.c (CVE-2019-17540)

  - ImageMagick: Use after free in ReadICCProfile function     in coders/jpeg.c (CVE-2019-17541)

  - ImageMagick: heap-based buffer overflow in WriteSGIImage     in coders/sgi.c (CVE-2019-19948)

  - ImageMagick: heap-based buffer over-read in     WritePNGImage in coders/png.c (CVE-2019-19949)

  - imagemagick: memory leak in function DecodeImage in     coders/pcd.c (CVE-2019-7175)

  - ImageMagick: Memory leak in the WritePDFImage function     in coders/pdf.c (CVE-2019-7397)

  - ImageMagick: Memory leak in the WriteDIBImage function     in coders/dib.c (CVE-2019-7398)

  - imagemagick: stack-based buffer overflow in function     PopHexPixel in coders/ps.c (CVE-2019-9956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2019-13301: Fixed a memory leak in     AcquireMagickMemory() (bsc#1140554).

  - CVE-2019-13309: Fixed a memory leak at     AcquireMagickMemory due to mishandling the NoSuchImage     error in CLIListOperatorImages (bsc#1140520).

  - CVE-2019-13310: Fixed a memory leak at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c (bsc#1140501).

  - CVE-2019-13311: Fixed a memory leak at     AcquireMagickMemory because of a wand/mogrify.c error     (bsc#1140513).

  - CVE-2019-13303: Fixed a heap-based buffer over-read in     MagickCore/composite.c in CompositeImage (bsc#1140549).

  - CVE-2019-13296: Fixed a memory leak in     AcquireMagickMemory because of an error in     CLIListOperatorImages in MagickWand/operation.c     (bsc#1140665).

  - CVE-2019-13299: Fixed a heap-based buffer over-read at     MagickCore/pixel-accessor.h in GetPixelChannel     (bsc#1140668).

  - CVE-2019-13454: Fixed a division by zero in     RemoveDuplicateLayers in MagickCore/layer.c     (bsc#1141171).

  - CVE-2019-13295: Fixed a heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage     (bsc#1140664).

  - CVE-2019-13297: Fixed a heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage     (bsc#1140666).

  - CVE-2019-12979: Fixed the use of uninitialized values in     SyncImageSettings() (bsc#1139886).

  - CVE-2019-13391: Fixed a heap-based buffer over-read in     MagickCore/fourier.c (bsc#1140673).

  - CVE-2019-13308: Fixed a heap-based buffer overflow in     MagickCore/fourier.c (bsc#1140534).

  - CVE-2019-13302: Fixed a heap-based buffer over-read in     MagickCore/fourier.c in ComplexImages (bsc#1140552).

  - CVE-2019-13298: Fixed a heap-based buffer overflow at     MagickCore/pixel-accessor.h in SetPixelViaPixelInfo     (bsc#1140667).

  - CVE-2019-13300: Fixed a heap-based buffer overflow at     MagickCore/statistic.c in EvaluateImages (bsc#1140669).

  - CVE-2019-13307: Fixed a heap-based buffer overflow at     MagickCore/statistic.c (bsc#1140538).

  - CVE-2019-12977: Fixed the use of uninitialized values in     WriteJP2Imag() (bsc#1139884).

  - CVE-2019-12975: Fixed a memory leak in the     WriteDPXImage() in coders/dpx.c (bsc#1140106).

  - CVE-2019-13135: Fixed the use of uninitialized values in     ReadCUTImage() (bsc#1140103).

  - CVE-2019-12978: Fixed the use of uninitialized values in     ReadPANGOImage() (bsc#1139885).

  - CVE-2019-12974: Fixed a NULL pointer dereference in the     ReadPANGOImage() (bsc#1140111).

  - CVE-2019-13304: Fixed a stack-based buffer overflow at     coders/pnm.c in WritePNMImage (bsc#1140547).

  - CVE-2019-13305: Fixed one more stack-based buffer     overflow at coders/pnm.c in WritePNMImage (bsc#1140545).

  - CVE-2019-13306: Fixed an additional stack-based buffer     overflow at coders/pnm.c in WritePNMImage (bsc#1140543).

  - CVE-2019-13133: Fixed a memory leak in the     ReadBMPImage() (bsc#1140100).

  - CVE-2019-13134: Fixed a memory leak in the     ReadVIFFImage() (bsc#1140102).

  - CVE-2019-13137: Fixed a memory leak in the ReadPSImage()     (bsc#1140105).

  - CVE-2019-13136: Fixed a integer overflow vulnerability     in the TIFFSeekCustomStream() (bsc#1140104).

  - CVE-2019-12976: Fixed a memory leak in the     ReadPCLImage() in coders/pcl.c(bsc#1140110).

This update was imported from the SUSE:SLE-15:Update update project.

Multiple vulnerabilities have been found in imagemagick, an image processing toolkit.

CVE-2019-12974

NULL pointer dereference in ReadPANGOImage and ReadVIDImage (coders/pango.c and coders/vid.c). This vulnerability might be leveraged by remote attackers to cause denial of service via crafted image data.

CVE-2019-13135

Multiple use of uninitialized values in ReadCUTImage, UnpackWPG2Raster and UnpackWPGRaster (coders/wpg.c and coders/cut.c). These vulnerabilities might be leveraged by remote attackers to cause denial of service or unauthorized disclosure or modification of information via crafted image data.

CVE-2019-13295, CVE-2019-13297

Multiple heap buffer over-reads in AdaptiveThresholdImage (magick/threshold.c). These vulnerabilities might be leveraged by remote attackers to cause denial of service or unauthorized disclosure or modification of information via crafted image data.

CVE-2019-13304, CVE-2019-13305, CVE-2019-13306

Multiple stack-based buffer overflows in WritePNMImage (coders/pnm.c), leading to stack buffer over write up to ten bytes. Remote attackers might leverage these flaws to potentially perform code execution or denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 8:6.8.9.9-5+deb8u17.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

CVE-2019-13301: Fixed a memory leak in AcquireMagickMemory() (bsc#1140554).

CVE-2019-13309: Fixed a memory leak at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (bsc#1140520).

CVE-2019-13310: Fixed a memory leak at AcquireMagickMemory because of an error in MagickWand/mogrify.c (bsc#1140501).

CVE-2019-13311: Fixed a memory leak at AcquireMagickMemory because of a wand/mogrify.c error (bsc#1140513).

CVE-2019-13303: Fixed a heap-based buffer over-read in MagickCore/composite.c in CompositeImage (bsc#1140549).

CVE-2019-13296: Fixed a memory leak in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c (bsc#1140665).

CVE-2019-13299: Fixed a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel (bsc#1140668).

CVE-2019-13454: Fixed a division by zero in RemoveDuplicateLayers in MagickCore/layer.c (bsc#1141171).

CVE-2019-13295: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140664).

CVE-2019-13297: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140666).

CVE-2019-12979: Fixed the use of uninitialized values in SyncImageSettings() (bsc#1139886).

CVE-2019-13391: Fixed a heap-based buffer over-read in MagickCore/fourier.c (bsc#1140673).

CVE-2019-13308: Fixed a heap-based buffer overflow in MagickCore/fourier.c (bsc#1140534).

CVE-2019-13302: Fixed a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages (bsc#1140552).

CVE-2019-13298: Fixed a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo (bsc#1140667).

CVE-2019-13300: Fixed a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages (bsc#1140669).

CVE-2019-13307: Fixed a heap-based buffer overflow at MagickCore/statistic.c (bsc#1140538).

CVE-2019-12977: Fixed the use of uninitialized values in WriteJP2Imag() (bsc#1139884).

CVE-2019-12975: Fixed a memory leak in the WriteDPXImage() in coders/dpx.c (bsc#1140106).

CVE-2019-13135: Fixed the use of uninitialized values in ReadCUTImage() (bsc#1140103).

CVE-2019-12978: Fixed the use of uninitialized values in ReadPANGOImage() (bsc#1139885).

CVE-2019-12974: Fixed a NULL pointer dereference in the ReadPANGOImage() (bsc#1140111).

CVE-2019-13304: Fixed a stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140547).

CVE-2019-13305: Fixed one more stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140545).

CVE-2019-13306: Fixed an additional stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140543).

CVE-2019-13133: Fixed a memory leak in the ReadBMPImage() (bsc#1140100).

CVE-2019-13134: Fixed a memory leak in the ReadVIFFImage() (bsc#1140102).

CVE-2019-13137: Fixed a memory leak in the ReadPSImage() (bsc#1140105).

CVE-2019-13136: Fixed a integer overflow vulnerability in the TIFFSeekCustomStream() (bsc#1140104).

CVE-2019-12976: Fixed a memory leak in the ReadPCLImage() in coders/pcl.c(bsc#1140110).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of ImageMagick installed on the remote Windows host is prior to 7.0.8-56. It is, therefore, affected by multiple vulnerabilities:

  - An integer overflow condition exists in the TIFFSeekCustomStream function. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a crafted image file, to cause a denial of service condition or the     execution of arbitrary code (CVE-2019-13136).
  - A stack-based buffer overflow condition exists in the WritePNMImage function due to an off-by-one error. An     unauthenticated,remote attacker can exploit this, by convincing a user to open a crafted image file, to cause a     denial of service condition or the execution of arbitrary code (CVE-2019-13306).

  - A heap-based buffer overflow condition exists in the EvaluateImages function due to a mishandling of rows. An     unauthenticated, remote attacker can exploit this, by convincing a user to open a crafted image file, to cause a     denial of service condition or the execution of arbitrary code (CVE-2019-13307).

Note that the application may also be affected by additional vulnerabilities. Refer to the vendor for additional information.

ID	Name	Product	Family	Severity
143991	NewStart CGSL CORE 5.05 / MAIN 5.05 : ImageMagick Multiple Vulnerabilities (NS-SA-2020-0119)	Nessus	NewStart CGSL Local Security Checks	high
143964	NewStart CGSL CORE 5.04 / MAIN 5.04 : ImageMagick Multiple Vulnerabilities (NS-SA-2020-0079)	Nessus	NewStart CGSL Local Security Checks	high
142319	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2020-2349)	Nessus	Huawei Local Security Checks	medium
141987	Amazon Linux 2 : ImageMagick (ALAS-2020-1497)	Nessus	Amazon Linux Local Security Checks	high
140857	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-2090)	Nessus	Huawei Local Security Checks	medium
139136	EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1806)	Nessus	Huawei Local Security Checks	medium
138633	Amazon Linux AMI : php-pecl-imagick (ALAS-2020-1391)	Nessus	Amazon Linux Local Security Checks	high
138104	Debian DSA-4715-1 : imagemagick - security update	Nessus	Debian Local Security Checks	high
135797	Scientific Linux Security Update : ImageMagick on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	high
135354	CentOS 7 : ImageMagick / autotrace / emacs / inkscape (CESA-2020:1180)	Nessus	CentOS Local Security Checks	high
135041	RHEL 7 : ImageMagick (RHSA-2020:1180)	Nessus	Red Hat Local Security Checks	high
131072	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : ImageMagick vulnerabilities (USN-4192-1)	Nessus	Ubuntu Local Security Checks	medium
128070	openSUSE Security Update : ImageMagick (openSUSE-2019-1983)	Nessus	SuSE Local Security Checks	medium
127924	Debian DLA-1888-1 : imagemagick security update	Nessus	Debian Local Security Checks	medium
127790	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2019:2106-1)	Nessus	SuSE Local Security Checks	medium
127051	ImageMagick < 7.0.8-56 Multiple vulnerabilities	Nessus	Windows	medium

CVE-2019-13306

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins