Amazon Linux AMI : GraphicsMagick (ALAS-2016-752)
High Nessus Plugin ID 94018
SynopsisThe remote Amazon Linux AMI host is missing a security update.
DescriptionA possible heap overflow was discovered in the EscapeParenthesis() function (CVE-2016-7447).
Various issues were found in the processing of SVG files in GraphicsMagick (CVE-2016-7446).
The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software (CVE-2016-7449).
The Utah RLE reader did not validate that header information was reasonable given the file size and so it could cause huge memory allocations and/or consume huge amounts of CPU, causing a denial of service (CVE-2016-7448)
SolutionRun 'yum update GraphicsMagick' to update your system.