drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in ImageMagick
Name: |
Mehrere Probleme in ImageMagick |
|
ID: |
SUSE-SU-2018:3348-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE Linux Enterprise Software Development Kit 11-SP4, SUSE Linux Enterprise Server 11-SP4, SUSE Linux Enterprise Debuginfo 11-SP4 |
|
Datum: |
Di, 23. Oktober 2018, 23:27 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18024
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17966
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16642
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16413
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16749
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16323
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16644
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16645
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16750
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17934
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18016 |
|
Applikationen: |
ImageMagick |
|
Originalnachricht |
SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________
Announcement ID: SUSE-SU-2018:3348-1 Rating: moderate References: #1074170 #1106855 #1106989 #1107604 #1107609 #1107612 #1107616 #1108282 #1108283 #1110746 #1110747 #1111069 #1111072 Cross-References: CVE-2017-17934 CVE-2018-16323 CVE-2018-16413 CVE-2018-16642 CVE-2018-16643 CVE-2018-16644 CVE-2018-16645 CVE-2018-16749 CVE-2018-16750 CVE-2018-17965 CVE-2018-17966 CVE-2018-18016 CVE-2018-18024 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________
An update that fixes 13 vulnerabilities is now available.
Description:
This update for ImageMagick fixes the following security issue:
- CVE-2017-17934: Prevent memory leaks, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls (bsc#1074170). - CVE-2018-16750: Prevent memory leak in the formatIPTCfromBuffer function (bsc#1108283) - CVE-2018-16749: Added missing NULL check in ReadOneJNGImage that allowed an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file (bsc#1108282) - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989). - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855) - CVE-2018-16642: The function InsertRow allowed remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write (bsc#1107616) - CVE-2018-16643: The functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage did check the return value of the fputc function, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107612) - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) - CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file (bsc#1111069) - CVE-2018-18016: Fixed a memory leak in WritePCXImage (bsc#1111072) - CVE-2018-17965: Fixed a memory leak in WriteSGIImage (bsc#1110747) - CVE-2018-17966: Fixed a memory leak in WritePDBImage (bsc#1110746)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-ImageMagick-13831=1
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-ImageMagick-13831=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-ImageMagick-13831=1
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):
ImageMagick-6.4.3.6-78.74.1 ImageMagick-devel-6.4.3.6-78.74.1 libMagick++-devel-6.4.3.6-78.74.1 libMagick++1-6.4.3.6-78.74.1 libMagickWand1-6.4.3.6-78.74.1 perl-PerlMagick-6.4.3.6-78.74.1
- SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64):
libMagickWand1-32bit-6.4.3.6-78.74.1
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
libMagickCore1-6.4.3.6-78.74.1
- SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):
libMagickCore1-32bit-6.4.3.6-78.74.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
ImageMagick-debuginfo-6.4.3.6-78.74.1 ImageMagick-debugsource-6.4.3.6-78.74.1
References:
https://www.suse.com/security/cve/CVE-2017-17934.html https://www.suse.com/security/cve/CVE-2018-16323.html https://www.suse.com/security/cve/CVE-2018-16413.html https://www.suse.com/security/cve/CVE-2018-16642.html https://www.suse.com/security/cve/CVE-2018-16643.html https://www.suse.com/security/cve/CVE-2018-16644.html https://www.suse.com/security/cve/CVE-2018-16645.html https://www.suse.com/security/cve/CVE-2018-16749.html https://www.suse.com/security/cve/CVE-2018-16750.html https://www.suse.com/security/cve/CVE-2018-17965.html https://www.suse.com/security/cve/CVE-2018-17966.html https://www.suse.com/security/cve/CVE-2018-18016.html https://www.suse.com/security/cve/CVE-2018-18024.html https://bugzilla.suse.com/1074170 https://bugzilla.suse.com/1106855 https://bugzilla.suse.com/1106989 https://bugzilla.suse.com/1107604 https://bugzilla.suse.com/1107609 https://bugzilla.suse.com/1107612 https://bugzilla.suse.com/1107616 https://bugzilla.suse.com/1108282 https://bugzilla.suse.com/1108283 https://bugzilla.suse.com/1110746 https://bugzilla.suse.com/1110747 https://bugzilla.suse.com/1111069 https://bugzilla.suse.com/1111072
_______________________________________________ sle-security-updates mailing list sle-security-updates@lists.suse.com http://lists.suse.com/mailman/listinfo/sle-security-updates
|
|
|
|