openSUSE Security Update : ImageMagick (openSUSE-2018-778)

Medium Nessus Plugin ID 111430

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for ImageMagick fixes the following issues :

The following security vulnerabilities were fixed :

- CVE-2018-11625: Fixed heap-based buffer over-read in SetGrayscaleImage in the quantize.c file, which allowed remote attackers to cause buffer over-read via a crafted file. (bsc#1096200)

- CVE-2018-11624: Fixed a use-after-free issue in the ReadMATImage function in coders/mat.c. (bsc#1096203)

- CVE-2018-10805: Fixed several memory leaks in bgr.c, rgb.c, cmyk.c, gray.c, and ycbcr.c (bsc#1095812)

- CVE-2018-12600: The ReadDIBImage and WriteDIBImage functions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098545).

- CVE-2018-12599: The ReadBMPImage and WriteBMPImage fucntions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098546).

The following other changes were made :

- Fix -gamma issues in special cases. (bsc#1094745, bsc#1094742)

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected ImageMagick packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1094742

https://bugzilla.opensuse.org/show_bug.cgi?id=1094745

https://bugzilla.opensuse.org/show_bug.cgi?id=1095812

https://bugzilla.opensuse.org/show_bug.cgi?id=1096200

https://bugzilla.opensuse.org/show_bug.cgi?id=1096203

https://bugzilla.opensuse.org/show_bug.cgi?id=1098545

https://bugzilla.opensuse.org/show_bug.cgi?id=1098546

Plugin Details

Severity: Medium

ID: 111430

File Name: openSUSE-2018-778.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2018/07/30

Modified: 2018/09/04

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSSv3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:ImageMagick, p-cpe:/a:novell:opensuse:ImageMagick-debuginfo, p-cpe:/a:novell:opensuse:ImageMagick-debugsource, p-cpe:/a:novell:opensuse:ImageMagick-devel, p-cpe:/a:novell:opensuse:ImageMagick-devel-32bit, p-cpe:/a:novell:opensuse:ImageMagick-extra, p-cpe:/a:novell:opensuse:ImageMagick-extra-debuginfo, p-cpe:/a:novell:opensuse:libMagick++-7_Q16HDRI4, p-cpe:/a:novell:opensuse:libMagick++-7_Q16HDRI4-32bit, p-cpe:/a:novell:opensuse:libMagick++-7_Q16HDRI4-32bit-debuginfo, p-cpe:/a:novell:opensuse:libMagick++-7_Q16HDRI4-debuginfo, p-cpe:/a:novell:opensuse:libMagick++-devel, p-cpe:/a:novell:opensuse:libMagick++-devel-32bit, p-cpe:/a:novell:opensuse:libMagickCore-7_Q16HDRI6, p-cpe:/a:novell:opensuse:libMagickCore-7_Q16HDRI6-32bit, p-cpe:/a:novell:opensuse:libMagickCore-7_Q16HDRI6-32bit-debuginfo, p-cpe:/a:novell:opensuse:libMagickCore-7_Q16HDRI6-debuginfo, p-cpe:/a:novell:opensuse:libMagickWand-7_Q16HDRI6, p-cpe:/a:novell:opensuse:libMagickWand-7_Q16HDRI6-32bit, p-cpe:/a:novell:opensuse:libMagickWand-7_Q16HDRI6-32bit-debuginfo, p-cpe:/a:novell:opensuse:libMagickWand-7_Q16HDRI6-debuginfo, p-cpe:/a:novell:opensuse:perl-PerlMagick, p-cpe:/a:novell:opensuse:perl-PerlMagick-debuginfo, cpe:/o:novell:opensuse:15.0

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2018/07/28

Reference Information

CVE: CVE-2018-10805, CVE-2018-11624, CVE-2018-11625, CVE-2018-12599, CVE-2018-12600