Security update for ImageMagick

Announcement ID:	SUSE-SU-2019:0739-1
Rating:	moderate
References:	bsc#1106415 bsc#1106996 bsc#1113064 bsc#1120381 bsc#1124365 bsc#1124366 bsc#1124367 bsc#1124368 bsc#1128649
Cross-References:	CVE-2018-16412 CVE-2018-18544 CVE-2018-20467 CVE-2019-7175 CVE-2019-7395 CVE-2019-7396 CVE-2019-7397 CVE-2019-7398
CVSS scores:	CVE-2018-16412 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2018-16412 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-18544 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-18544 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20467 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-20467 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20467 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7175 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7175 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7175 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7395 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7395 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7395 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7396 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7396 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7396 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7397 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7397 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7397 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7398 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7398 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-7398 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	Desktop Applications Module 15 Development Tools Module 15 SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server for SAP Applications 15

An update that solves eight vulnerabilities and has one security fix can now be installed.

Description:

This update for ImageMagick fixes the following issues:

Security issues fixed:

• CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649).
• CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage (bsc#1113064).
• CVE-2018-20467: Fixed an infinite loop in coders/bmp.c (bsc#1120381).
• CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365).
• CVE-2019-7396: Fixed a memory leak in the function ReadSIXELImage (bsc#1124367).
• CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368).
• CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366).
• CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996).

Non-security issue fixed:

• Fixed a regression in regards to the 'edge' comand line flag (bsc#1106415)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Desktop Applications Module 15
  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2019-739=1
• Development Tools Module 15
  zypper in -t patch SUSE-SLE-Module-Development-Tools-15-2019-739=1

Package List:

• Desktop Applications Module 15 (aarch64 ppc64le s390x x86_64)
  • libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-3.49.4
  • ImageMagick-debuginfo-7.0.7.34-3.49.4
  • ImageMagick-7.0.7.34-3.49.4
  • libMagick++-7_Q16HDRI4-7.0.7.34-3.49.4
  • libMagick++-devel-7.0.7.34-3.49.4
  • ImageMagick-devel-7.0.7.34-3.49.4
  • libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-3.49.4
  • libMagickWand-7_Q16HDRI6-7.0.7.34-3.49.4
  • libMagickCore-7_Q16HDRI6-7.0.7.34-3.49.4
  • libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-3.49.4
  • ImageMagick-debugsource-7.0.7.34-3.49.4
• Development Tools Module 15 (aarch64 ppc64le s390x x86_64)
  • perl-PerlMagick-7.0.7.34-3.49.4
  • ImageMagick-debugsource-7.0.7.34-3.49.4
  • perl-PerlMagick-debuginfo-7.0.7.34-3.49.4
  • ImageMagick-debuginfo-7.0.7.34-3.49.4

References:

• https://www.suse.com/security/cve/CVE-2018-16412.html
• https://www.suse.com/security/cve/CVE-2018-18544.html
• https://www.suse.com/security/cve/CVE-2018-20467.html
• https://www.suse.com/security/cve/CVE-2019-7175.html
• https://www.suse.com/security/cve/CVE-2019-7395.html
• https://www.suse.com/security/cve/CVE-2019-7396.html
• https://www.suse.com/security/cve/CVE-2019-7397.html
• https://www.suse.com/security/cve/CVE-2019-7398.html
• https://bugzilla.suse.com/show_bug.cgi?id=1106415
• https://bugzilla.suse.com/show_bug.cgi?id=1106996
• https://bugzilla.suse.com/show_bug.cgi?id=1113064
• https://bugzilla.suse.com/show_bug.cgi?id=1120381
• https://bugzilla.suse.com/show_bug.cgi?id=1124365
• https://bugzilla.suse.com/show_bug.cgi?id=1124366
• https://bugzilla.suse.com/show_bug.cgi?id=1124367
• https://bugzilla.suse.com/show_bug.cgi?id=1124368
• https://bugzilla.suse.com/show_bug.cgi?id=1128649