SUSE-SU-2018:0055-1

Dashboard / Vulnerabilities / SUSE-SU-2018:0055-1

SUSE-SU-2018:0055-1

Summary: Security update for ImageMagick

Details: This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-1000476: A CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allowed attackers to cause a denial of service (bsc#1074610). - CVE-2017-9409: The ReadMPCImage function in mpc.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1042948). - CVE-2017-1000445: A NULL pointer dereference in the MagickCore component might have lead to denial of service (bsc#1074425). - CVE-2017-17680: Prevent a memory leak in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted XPM image file (a different vulnerability than CVE-2017-17882) (bsc#1072902). - CVE-2017-17882: Prevent a memory leak in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted XPM image file (a different vulnerability than CVE-2017-17680) (bsc#1074122). - CVE-2017-11449: coders/mpc did not enable seekable streams and thus could not validate blob sizes, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin (bsc#1049373). - CVE-2017-12430: A memory exhaustion in the function ReadMPCImage in coders/mpc.c allowed attackers to cause DoS (bsc#1052252). - CVE-2017-12642: Prevent a memory leak vulnerability in ReadMPCImage in coders\mpc.c via crafted file allowing for DoS (bsc#1052771). - CVE-2017-14249: A mishandled EOF check in ReadMPCImage in coders/mpc.c that lead to a division by zero in GetPixelCacheTileSize in MagickCore/cache.c allowed remote attackers to cause a denial of service via a crafted file (bsc#1058082). - Prevent memory leak via crafted file in pwp.c allowing for DoS (bsc#1051412)

References: https://www.suse.com/support/update/announcement/2018/suse-su-20180055-1/, https://bugzilla.suse.com/1042948, https://bugzilla.suse.com/1049373, https://bugzilla.suse.com/1051412, https://bugzilla.suse.com/1052252, https://bugzilla.suse.com/1052771, https://bugzilla.suse.com/1058082, https://bugzilla.suse.com/1072902, https://bugzilla.suse.com/1074122, https://bugzilla.suse.com/1074425, https://bugzilla.suse.com/1074610, https://www.suse.com/security/cve/CVE-2017-1000445, https://www.suse.com/security/cve/CVE-2017-1000476, https://www.suse.com/security/cve/CVE-2017-11449, https://www.suse.com/security/cve/CVE-2017-11751, https://www.suse.com/security/cve/CVE-2017-12430, https://www.suse.com/security/cve/CVE-2017-12642, https://www.suse.com/security/cve/CVE-2017-14249, https://www.suse.com/security/cve/CVE-2017-17680, https://www.suse.com/security/cve/CVE-2017-17882, https://www.suse.com/security/cve/CVE-2017-9409