Main Vulnerability Database SB2018091702

SB2018091702 - OpenSUSE Linux update for GraphicsMagick

Published: September 17, 2018

Security Bulletin ID SB2018091702

Severity

Low

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2018-16644)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient check for length in ReadDCMImage() function in coders/dcm.c and in ReadPICTImage() function in coders/pict.c. A remote attacker can pass a specially crafted image to the affected application and trigger application crash.

2) Buffer overflow (CVE-ID: CVE-2018-16645)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ReadBMPImage() function in coders/bmp.c and in ReadDIBImage() function in coders/dib.c. A remote attacker can create a specially crafted image, pass it to the affected application and trigger application crash due to memory allocation error.

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00038.html