Security update for GraphicsMagick

Announcement ID: SUSE-SU-2017:0518-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2016-10048 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2016-10049 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10049 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10050 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10050 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10051 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10051 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10059 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10064 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10064 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10065 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2016-10068 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2016-10070 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2016-10070 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2016-10146 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-5511 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise Software Development Kit 11 SP4
  • SUSE Studio Onsite 1.3

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for GraphicsMagick fixes several issues.

These security issues were fixed:

  • CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310).
  • CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311).
  • CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312).
  • CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313).
  • CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318).
  • CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321).
  • CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322).
  • CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324).
  • CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326).
  • CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443).
  • CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Software Development Kit 11 SP4
    zypper in -t patch sdksp4-GraphicsMagick-12994=1
  • SUSE Studio Onsite 1.3
    zypper in -t patch slestso13-GraphicsMagick-12994=1

Package List:

  • SUSE Linux Enterprise Software Development Kit 11 SP4 (s390x x86_64 i586 ppc64 ia64)
    • libGraphicsMagick2-1.2.5-4.62.1
    • GraphicsMagick-1.2.5-4.62.1
    • perl-GraphicsMagick-1.2.5-4.62.1
  • SUSE Studio Onsite 1.3 (x86_64)
    • libGraphicsMagick2-1.2.5-4.62.1
    • GraphicsMagick-1.2.5-4.62.1

References: