openSUSE-SU-2019:1983

https://github.com/ImageMagick/ImageMagick/commit/7c2c5ba5b8e3a0b2b82f56c71dfab74ed4006df7

https://github.com/ImageMagick/ImageMagick/issues/1588

https://github.com/ImageMagick/ImageMagick6/commit/f6ffc702c6eecd963587273a429dcd608c648984

[debian-lts-announce] 20200907 [SECURITY] [DLA 2366-1] imagemagick security update

USN-4192-1

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadBMPImage in     coders/bmp.c.(CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadVIFFImage in     coders/viff.c.(CVE-2019-13134)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in     the WriteDPXImage function in     coders/dpx.c.(CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadPSImage in     coders/ps.c.(CVE-2019-13137)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in     AcquireMagickMemory because of an AnnotateImage     error.(CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in     RemoveDuplicateLayers in     MagickCore/layer.c.(CVE-2019-13454)

  - ImageMagick version 7.0.7-28 contains a memory leak in     ReadYCBCRImage in coders/ycbcr.c.(CVE-2018-10805)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick version 7.0.7-28 contains a memory leak in     ReadYCBCRImage in coders/ycbcr.c.(CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in     the WriteDPXImage function in     coders/dpx.c.(CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak     vulnerability in the function ReadPSImage in     coders/ps.c.(CVE-2019-13137)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in     AcquireMagickMemory because of an AnnotateImage     error.(CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in     RemoveDuplicateLayers in     MagickCore/layer.c.(CVE-2019-13454)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Debian Bug : 870020 870019 876105 869727 886281 873059 870504 870530 870107 872609 875338 875339 875341 873871 873131 875352 878506 875503 875502 876105 876099 878546 878545 877354 877355 878524 878547 878548 878555 878554 878548 878555 878554 878579 885942 886584 928206 941670 931447 932079

Several security vulnerabilities were found in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u10.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL     check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob     assertion failure and application exit) via a crafted     file.(CVE-2018-16749)

  - A NULL pointer dereference in the function     ReadPANGOImage in coders/pango.c and the function     ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34     allows remote attackers to cause a denial of service     via a crafted image.(CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak in the     ReadPCLImage function in coders/pcl.c.(CVE-2019-12976)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of mishandling the     NoSuchImage error in CLIListOperatorImages in     MagickWand/operation.c.(CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c.(CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at     AcquireMagickMemory because of a wand/mogrify.c     error.(CVE-2019-13311)

  - In ImageMagick 7.0.7-28, there is an infinite loop in     the ReadOneMNGImage function of the coders/png.c file.
    Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted mng     file.(CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in     WriteTIFFImage in coders/tiff.c.(CVE-2018-10804)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WritePSDChannel in coders/psd.c.(CVE-2019-7395)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     ReadSIXELImage in coders/sixel.c.(CVE-2019-7396)

  - In ImageMagick before 7.0.8-25, a memory leak exists in     WriteDIBImage in coders/dib.c.(CVE-2019-7398)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the WriteJP2Image function in     coders/jp2.c.(CVE-2019-12977)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the ReadPANGOImage function in     coders/pango.c.(CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a 'use of uninitialized value'     vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in     magick/image.c.(CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is     mishandled.(CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is     mishandled.(CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns.(CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment.(CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one     error.(CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer     overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors.(CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows.(CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer     overflow in MagickCore/fourier.c in     ComplexImage.(CVE-2019-13308)

  - In ImageMagick 7.0.8-50 Q16, ComplexImages in     MagickCore/fourier.c has a heap-based buffer over-read     because of incorrect calls to     GetCacheViewVirtualPixels.(CVE-2019-13391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2019-13301: Fixed a memory leak in     AcquireMagickMemory() (bsc#1140554).

  - CVE-2019-13309: Fixed a memory leak at     AcquireMagickMemory due to mishandling the NoSuchImage     error in CLIListOperatorImages (bsc#1140520).

  - CVE-2019-13310: Fixed a memory leak at     AcquireMagickMemory because of an error in     MagickWand/mogrify.c (bsc#1140501).

  - CVE-2019-13311: Fixed a memory leak at     AcquireMagickMemory because of a wand/mogrify.c error     (bsc#1140513).

  - CVE-2019-13303: Fixed a heap-based buffer over-read in     MagickCore/composite.c in CompositeImage (bsc#1140549).

  - CVE-2019-13296: Fixed a memory leak in     AcquireMagickMemory because of an error in     CLIListOperatorImages in MagickWand/operation.c     (bsc#1140665).

  - CVE-2019-13299: Fixed a heap-based buffer over-read at     MagickCore/pixel-accessor.h in GetPixelChannel     (bsc#1140668).

  - CVE-2019-13454: Fixed a division by zero in     RemoveDuplicateLayers in MagickCore/layer.c     (bsc#1141171).

  - CVE-2019-13295: Fixed a heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage     (bsc#1140664).

  - CVE-2019-13297: Fixed a heap-based buffer over-read at     MagickCore/threshold.c in AdaptiveThresholdImage     (bsc#1140666).

  - CVE-2019-12979: Fixed the use of uninitialized values in     SyncImageSettings() (bsc#1139886).

  - CVE-2019-13391: Fixed a heap-based buffer over-read in     MagickCore/fourier.c (bsc#1140673).

  - CVE-2019-13308: Fixed a heap-based buffer overflow in     MagickCore/fourier.c (bsc#1140534).

  - CVE-2019-13302: Fixed a heap-based buffer over-read in     MagickCore/fourier.c in ComplexImages (bsc#1140552).

  - CVE-2019-13298: Fixed a heap-based buffer overflow at     MagickCore/pixel-accessor.h in SetPixelViaPixelInfo     (bsc#1140667).

  - CVE-2019-13300: Fixed a heap-based buffer overflow at     MagickCore/statistic.c in EvaluateImages (bsc#1140669).

  - CVE-2019-13307: Fixed a heap-based buffer overflow at     MagickCore/statistic.c (bsc#1140538).

  - CVE-2019-12977: Fixed the use of uninitialized values in     WriteJP2Imag() (bsc#1139884).

  - CVE-2019-12975: Fixed a memory leak in the     WriteDPXImage() in coders/dpx.c (bsc#1140106).

  - CVE-2019-13135: Fixed the use of uninitialized values in     ReadCUTImage() (bsc#1140103).

  - CVE-2019-12978: Fixed the use of uninitialized values in     ReadPANGOImage() (bsc#1139885).

  - CVE-2019-12974: Fixed a NULL pointer dereference in the     ReadPANGOImage() (bsc#1140111).

  - CVE-2019-13304: Fixed a stack-based buffer overflow at     coders/pnm.c in WritePNMImage (bsc#1140547).

  - CVE-2019-13305: Fixed one more stack-based buffer     overflow at coders/pnm.c in WritePNMImage (bsc#1140545).

  - CVE-2019-13306: Fixed an additional stack-based buffer     overflow at coders/pnm.c in WritePNMImage (bsc#1140543).

  - CVE-2019-13133: Fixed a memory leak in the     ReadBMPImage() (bsc#1140100).

  - CVE-2019-13134: Fixed a memory leak in the     ReadVIFFImage() (bsc#1140102).

  - CVE-2019-13137: Fixed a memory leak in the ReadPSImage()     (bsc#1140105).

  - CVE-2019-13136: Fixed a integer overflow vulnerability     in the TIFFSeekCustomStream() (bsc#1140104).

  - CVE-2019-12976: Fixed a memory leak in the     ReadPCLImage() in coders/pcl.c(bsc#1140110).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ImageMagick fixes the following issues :

CVE-2019-13301: Fixed a memory leak in AcquireMagickMemory() (bsc#1140554).

CVE-2019-13309: Fixed a memory leak at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (bsc#1140520).

CVE-2019-13310: Fixed a memory leak at AcquireMagickMemory because of an error in MagickWand/mogrify.c (bsc#1140501).

CVE-2019-13311: Fixed a memory leak at AcquireMagickMemory because of a wand/mogrify.c error (bsc#1140513).

CVE-2019-13303: Fixed a heap-based buffer over-read in MagickCore/composite.c in CompositeImage (bsc#1140549).

CVE-2019-13296: Fixed a memory leak in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c (bsc#1140665).

CVE-2019-13299: Fixed a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel (bsc#1140668).

CVE-2019-13454: Fixed a division by zero in RemoveDuplicateLayers in MagickCore/layer.c (bsc#1141171).

CVE-2019-13295: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140664).

CVE-2019-13297: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140666).

CVE-2019-12979: Fixed the use of uninitialized values in SyncImageSettings() (bsc#1139886).

CVE-2019-13391: Fixed a heap-based buffer over-read in MagickCore/fourier.c (bsc#1140673).

CVE-2019-13308: Fixed a heap-based buffer overflow in MagickCore/fourier.c (bsc#1140534).

CVE-2019-13302: Fixed a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages (bsc#1140552).

CVE-2019-13298: Fixed a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo (bsc#1140667).

CVE-2019-13300: Fixed a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages (bsc#1140669).

CVE-2019-13307: Fixed a heap-based buffer overflow at MagickCore/statistic.c (bsc#1140538).

CVE-2019-12977: Fixed the use of uninitialized values in WriteJP2Imag() (bsc#1139884).

CVE-2019-12975: Fixed a memory leak in the WriteDPXImage() in coders/dpx.c (bsc#1140106).

CVE-2019-13135: Fixed the use of uninitialized values in ReadCUTImage() (bsc#1140103).

CVE-2019-12978: Fixed the use of uninitialized values in ReadPANGOImage() (bsc#1139885).

CVE-2019-12974: Fixed a NULL pointer dereference in the ReadPANGOImage() (bsc#1140111).

CVE-2019-13304: Fixed a stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140547).

CVE-2019-13305: Fixed one more stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140545).

CVE-2019-13306: Fixed an additional stack-based buffer overflow at coders/pnm.c in WritePNMImage (bsc#1140543).

CVE-2019-13133: Fixed a memory leak in the ReadBMPImage() (bsc#1140100).

CVE-2019-13134: Fixed a memory leak in the ReadVIFFImage() (bsc#1140102).

CVE-2019-13137: Fixed a memory leak in the ReadPSImage() (bsc#1140105).

CVE-2019-13136: Fixed a integer overflow vulnerability in the TIFFSeekCustomStream() (bsc#1140104).

CVE-2019-12976: Fixed a memory leak in the ReadPCLImage() in coders/pcl.c(bsc#1140110).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

CVE-2019-13301: Fixed a memory leak in AcquireMagickMemory() (bsc#1140554).

CVE-2019-13310: Fixed a memory leak at AcquireMagickMemory because of an error in MagickWand/mogrify.c (bsc#1140501).

CVE-2019-13311: Fixed a memory leak at AcquireMagickMemory because of a wand/mogrify.c error (bsc#1140513).

CVE-2019-13454: Fixed a division by zero in RemoveDuplicateLayers in MagickCore/layer.c (bsc#1141171).

CVE-2019-13295: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140664).

CVE-2019-13297: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140666).

CVE-2019-12979: Fixed the use of uninitialized values in SyncImageSettings() (bsc#1139886).

CVE-2019-13391: Fixed a heap-based buffer over-read in MagickCore/fourier.c (bsc#1140673).

CVE-2019-13308: Fixed a heap-based buffer overflow in MagickCore/fourier.c (bsc#1140534).

CVE-2019-13300: Fixed a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages (bsc#1140669).

CVE-2019-13307: Fixed a heap-based buffer overflow at MagickCore/statistic.c (bsc#1140538).

CVE-2019-12975: Fixed a memory leak in the WriteDPXImage() in coders/dpx.c (bsc#1140106).

CVE-2019-13135: Fixed the use of uninitialized values in ReadCUTImage() (bsc#1140103).

CVE-2019-12978: Fixed the use of uninitialized values in ReadPANGOImage() (bsc#1139885).

CVE-2019-12974: Fixed a NULL pointer dereference in the ReadPANGOImage() (bsc#1140111).

CVE-2019-13133: Fixed a memory leak in the ReadBMPImage() (bsc#1140100).

CVE-2019-13134: Fixed a memory leak in the ReadVIFFImage() (bsc#1140102).

CVE-2019-12976: Fixed a memory leak in the ReadPCLImage() in coders/pcl.c(bsc#1140110).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
142319	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2020-2349)	Nessus	Huawei Local Security Checks	medium
140857	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-2090)	Nessus	Huawei Local Security Checks	medium
140297	Debian DLA-2366-1 : imagemagick security update	Nessus	Debian Local Security Checks	high
139136	EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1806)	Nessus	Huawei Local Security Checks	medium
131072	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : ImageMagick vulnerabilities (USN-4192-1)	Nessus	Ubuntu Local Security Checks	medium
128070	openSUSE Security Update : ImageMagick (openSUSE-2019-1983)	Nessus	SuSE Local Security Checks	medium
127790	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2019:2106-1)	Nessus	SuSE Local Security Checks	medium
127750	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2019:2010-1)	Nessus	SuSE Local Security Checks	medium

CVE-2019-13391

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium