SB2018102908 - OpenSUSE Linux update for ImageMagick

Security Bulletin ID SB2018102908

Severity

Low

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Integer underflow (CVE-ID: CVE-2017-14997)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer underflow condition in the ReadPICTImage function, as defined in the coders/pict.c source code. A remote attacker can trick the victim into accessing a malicious image file, trigger memory allocation failure, resulting in a DoS condition on the targeted system.

2) Input validation error (CVE-ID: CVE-2018-16644)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient check for length in ReadDCMImage() function in coders/dcm.c and in ReadPICTImage() function in coders/pict.c. A remote attacker can pass a specially crafted image to the affected application and trigger application crash.

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00079.html