This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues.

These security issues were fixed :

  - CVE-2018-8804: The WriteEPTImage function allowed remote     attackers to cause a denial of service (double free and     application crash) or possibly have unspecified other     impact via a crafted file (bsc#1086011).

  - CVE-2017-11524: The WriteBlob function allowed remote     attackers to cause a denial of service (assertion     failure and application exit) via a crafted file     (bsc#1050087).

  - CVE-2017-18209: Prevent NULL pointer dereference in the     GetOpenCLCachedFilesDirectory function caused by a     memory allocation result that was not checked, related     to GetOpenCLCacheDirectory (bsc#1083628).

  - CVE-2017-18211: Prevent NULL pointer dereference in the     function saveBinaryCLProgram caused by a program-lookup     result not being checked, related to CacheOpenCLKernel     (bsc#1083634).

  - CVE-2017-9500: Prevent assertion failure in the function     ResetImageProfileIterator, which allowed attackers to     cause a denial of service via a crafted file     (bsc#1043290).

  - CVE-2017-14739: The AcquireResampleFilterThreadSet     function mishandled failed memory allocation, which     allowed remote attackers to cause a denial of service     (NULL pointer Dereference in DistortImage in     MagickCore/distort.c, and application crash) via     unspecified vectors (bsc#1060382).

  - CVE-2017-16353: Prevent memory information disclosure in     the DescribeImage function caused by a heap-based buffer     over-read. The portion of the code containing the     vulnerability is responsible for printing the IPTC     Profile information contained in the image. This     vulnerability can be triggered with a specially crafted     MIFF file. There is an out-of-bounds buffer dereference     because certain increments were never checked     (bsc#1066170).

  - CVE-2017-16352: Prevent a heap-based buffer overflow in     the 'Display visual image directory' feature of the     DescribeImage() function. One possible way to trigger     the vulnerability is to run the identify command on a     specially crafted MIFF format file with the verbose flag     (bsc#1066168).

  - CVE-2017-14314: Prevent off-by-one error in the     DrawImage function that allowed remote attackers to     cause a denial of service (DrawDashPolygon heap-based     buffer over-read and application crash) via a crafted     file (bsc#1058630).

  - CVE-2017-13768: Prevent NULL pointer dereference in the     IdentifyImage function that allowed an attacker to     perform denial of service by sending a crafted image     file (bsc#1056434).

  - CVE-2017-14505: Fixed handling of NULL arrays, which     allowed attackers to perform Denial of Service (NULL     pointer dereference and application crash in     AcquireQuantumMemory within MagickCore/memory.c) by     providing a crafted Image File as input (bsc#1059735).

  - CVE-2018-7470: The IsWEBPImageLossless function allowed     attackers to cause a denial of service (segmentation     violation) via a crafted file (bsc#1082837).

  - CVE-2018-7443: The ReadTIFFImage function did not     properly validate the amount of image data in a file,     which allowed remote attackers to cause a denial of     service (memory allocation failure in the     AcquireMagickMemory function in MagickCore/memory.c)     (bsc#1082792).

  - CVE-2017-15016: Prevent NULL pointer dereference     vulnerability in ReadEnhMetaFile allowing for denial of     service (bsc#1082291).

  - CVE-2017-15017: Prevent NULL pointer dereference     vulnerability in ReadOneMNGImage allowing for denial of     service (bsc#1082283).

  - CVE-2017-12692: The ReadVIFFImage function allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted VIFF file (bsc#1082362).

  - CVE-2017-12693: The ReadBMPImage function allowed remote     attackers to cause a denial of service (memory     consumption) via a crafted BMP file (bsc#1082348). This     update was imported from the SUSE:SLE-12:Update update     project.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: Uninitialized variable in coders/mat.c:ReadMATImageV4() allows for memory corruption     (CVE-2018-14551)

  - ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore     component and might lead to denial of service (CVE-2017-1000445)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage     in coders/png.c, related to length calculation and caused by an off-by-one error. (CVE-2017-17879)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage     in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check. (CVE-2017-17880)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allows attackers to cause a denial of service via a crafted MAT image file.
    (CVE-2017-17881)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in     coders/xpm.c, which allows attackers to cause a denial of service via a crafted XPM image file.
    (CVE-2017-17882)

  - In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in     coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file.
    (CVE-2017-17884)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in     coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.
    (CVE-2017-17885)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in     coders/psd.c, which allows attackers to cause a denial of service via a crafted psd image file.
    (CVE-2017-17886)

  - In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in     magick/cache.c, which allows attackers to cause a denial of service via a crafted MNG image file that is     processed by ReadOneMNGImage. (CVE-2017-17887)

  - In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c,     which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image     file. (CVE-2017-17914)

  - ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and     ProcessMSLScript, and associated with mishandling of MSLPushImage calls. (CVE-2017-17934)

  - In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c. (CVE-2017-18008)

  - In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.
    (CVE-2017-18022)

  - In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18027)

  - In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in     coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18028)

  - In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18029)

  - In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer     dereference vulnerability occurs because a memory allocation result is not checked, related to     GetOpenCLCacheDirectory. (CVE-2017-18209)

  - In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function     BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocation result is not checked.
    (CVE-2017-18210)

  - In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function     saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to     CacheOpenCLKernel. (CVE-2017-18211)

  - An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the     function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service     via a crafted file. (CVE-2017-18250)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the     function LoadOpenCLDevices in MagickCore/opencl.c, which allows attackers to cause a denial of service via     a crafted file. (CVE-2017-18253)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in     coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is     mishandled in an MngInfoDiscardObject call. (CVE-2017-18272)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in     coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage     in MagickCore/quantize.c) via a crafted SUN image file. (CVE-2018-11251)

  - In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use     after free via a crafted file. (CVE-2018-11624)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function     GetImagePixelCache in MagickCore/cache.c, which allows attackers to cause a denial of service via a     crafted CALS image file. (CVE-2018-11655)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an     XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process     that includes sensitive information, that information sometimes can be leaked via the image data.
    (CVE-2018-16323)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
    (CVE-2018-5246)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. (CVE-2018-5247)

  - ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c. (CVE-2018-5357)

  - In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and     bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a     memory leak. This allows remote attackers to cause a denial of service. (CVE-2018-6405)

  - The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other     products, allows remote attackers to cause a denial of service (stack-based buffer under-read) via a     crafted bmp image. (CVE-2018-6876)

  - A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of     ImageMagick 7.0.7-22 allows a remote attacker to cause a denial of service (application crash) via a     maliciously crafted pict file. (CVE-2018-6930)

  - The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the     amount of image data in a file, which allows remote attackers to cause a denial of service (memory     allocation failure in the AcquireMagickMemory function in MagickCore/memory.c). (CVE-2018-7443)

  - An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c     allows attackers to cause a denial of service (segmentation violation) via a crafted file. (CVE-2018-7470)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory     allocation, leading to a heap-based buffer over-read. (CVE-2018-8960)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in     coders/webp.c. (CVE-2018-9135)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
195362	RHEL 5 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/13/2024	critical
108824	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0857-1)	Nessus	SuSE Local Security Checks	4/4/2018	9/10/2019	critical
195345	RHEL 7 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
108935	openSUSE Security Update : ImageMagick (openSUSE-2018-343)	Nessus	SuSE Local Security Checks	4/10/2018	1/19/2021	critical
195375	RHEL 8 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
195417	RHEL 6 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical