Security fix for CVE-2017-11403

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file. (CVE-2017-1000061)

This update for ImageMagick fixes the following issues :

Security issues fixed :

  - CVE-2017-9439: A memory leak was found in the function     ReadPDBImage incoders/pdb.c (bsc#1042826)

  - CVE-2017-9440: A memory leak was found in the function     ReadPSDChannelin coders/psd.c (bsc#1042812)

  - CVE-2017-9501: An assertion failure could cause a denial     of service via a crafted file (bsc#1043289)

  - CVE-2017-11403: ReadMNGImage function in coders/png.c     has an out-of-order CloseBlob call, resulting in a     use-after-free via acrafted file (bsc#1049072)

This update was imported from the SUSE:SLE-12:Update update project.

Several vulnerabilities have been discovered in GraphicsMagick, a set of command-line applications to manipulate image files, which could result in denial of service or the execution of arbitrary code if malformed image files are processed.

This update for ImageMagick fixes the following issues: Security issues fixed :

  - CVE-2017-9439: A memory leak was found in the function     ReadPDBImage incoders/pdb.c (bsc#1042826)

  - CVE-2017-9440: A memory leak was found in the function     ReadPSDChannelin coders/psd.c (bsc#1042812)

  - CVE-2017-9501: An assertion failure could cause a denial     of service via a crafted file (bsc#1043289)

  - CVE-2017-11403: ReadMNGImage function in coders/png.c     has an out-of-order CloseBlob call, resulting in a     use-after-free via acrafted file (bsc#1049072)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various vulnerabilities were discovered in graphicsmagick, a collection of image processing tools and associated libraries, resulting in denial of service, information disclosure, and a variety of buffer overflows and overreads.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.20-3+deb8u4.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-10794, CVE-2017-10799, CVE-2017-11102, CVE-2017-11140, CVE-2017-11403, CVE-2017-11636, CVE-2017-11637, CVE-2017-13147, CVE-2017-14042, CVE-2017-6335).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security vulnerabilities, NULL pointer dereferences, use-after-free and heap based overflows, were discovered in graphicsmagick that can lead to denial of service by consuming all available memory or segmentation faults.

For Debian 7 'Wheezy', these problems have been fixed in version 1.3.16-1.1+deb7u8.

We recommend that you upgrade your graphicsmagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for GraphicsMagick fixes the following issue :

  - CVE-2017-11403: A specially crafted PNG file may have     have triggerd a use-after-free flaw (boo#1049072)

This update for ImageMagick fixes the following issues: Security issues fixed :

  - CVE-2017-9439: A memory leak was found in the function     ReadPDBImage incoders/pdb.c (bsc#1042826)

  - CVE-2017-9501: An assertion failure could cause a denial     of service via a crafted file (bsc#1043289)

  - CVE-2017-11403: ReadMNGImage function in coders/png.c     has an out-of-order CloseBlob call, resulting in a     use-after-free via acrafted file (bsc#1049072)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
101999	Fedora 24 : GraphicsMagick (2017-758fafed81)	Nessus	Fedora Local Security Checks	7/27/2017	1/6/2021	high
103225	Amazon Linux AMI : GraphicsMagick (ALAS-2017-891)	Nessus	Amazon Linux Local Security Checks	9/15/2017	4/18/2018	high
102809	openSUSE Security Update : ImageMagick (openSUSE-2017-971)	Nessus	SuSE Local Security Checks	8/29/2017	1/19/2021	high
118179	Debian DSA-4321-1 : graphicsmagick - security update	Nessus	Debian Local Security Checks	10/18/2018	7/15/2019	critical
101996	Fedora 25 : GraphicsMagick (2017-6c52e2d731)	Nessus	Fedora Local Security Checks	7/27/2017	1/6/2021	high
102577	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:2199-1)	Nessus	SuSE Local Security Checks	8/18/2017	1/6/2021	high
111520	Debian DLA-1456-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	8/3/2018	1/11/2021	critical
131695	Ubuntu 16.04 LTS : GraphicsMagick vulnerabilities (USN-4206-1)	Nessus	Ubuntu Local Security Checks	12/4/2019	10/20/2023	critical
101914	Fedora 26 : GraphicsMagick (2017-0446b53fd8)	Nessus	Fedora Local Security Checks	7/24/2017	1/11/2021	high
102043	Debian DLA-1045-1 : graphicsmagick security update	Nessus	Debian Local Security Checks	7/31/2017	1/11/2021	critical
102053	openSUSE Security Update : GraphicsMagick (openSUSE-2017-851)	Nessus	SuSE Local Security Checks	7/31/2017	1/19/2021	high
102542	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2017:2176-1)	Nessus	SuSE Local Security Checks	8/17/2017	1/19/2021	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

critical

critical

high

critical

high

high