Alpine: multiple graphicsmagick packages: security update to 1.3.26-r4 (deprecated)

high Tenable Cloud Security Plugin ID 400809

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in
coders/svg.c. (CVE-2017-13065)

- In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in
coders/mat.c. (CVE-2017-13648)

- A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick
1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in
the MagickRealloc function in magick/memory.c. (CVE-2017-14042)

- The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly
manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-
free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this
vulnerability exists because of an incomplete fix for CVE-2017-11403. (CVE-2017-14103)

- The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is
excessive because it depends only on a length field in a header. This may lead to remote denial of service
in the MagickMalloc function in magick/memory.c. (CVE-2017-14165)

Plugin Details

Severity: High

ID: 400809

Version: Revision 1.22

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-14103

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/3/2017

Vulnerability Publication Date: 8/22/2017

Reference Information

CVE: CVE-2017-13065, CVE-2017-13648, CVE-2017-14042, CVE-2017-14103, CVE-2017-14165

BID: 100556, 100971, 100678

Detections

Analytics