SB2019040511 - OpenSUSE Linux update for ImageMagick
Published: April 5, 2019 Updated: May 15, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Buffer over-read (CVE-ID: CVE-2018-16412)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function. A remote attacker can perform a denial of service attack.
2) Memory leak (CVE-ID: CVE-2018-18544)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to memory leak in the WriteMSLImage function, as defined in the coders/msl.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input, trigger memory leak and cause the service to crash.
3) Infinite loop (CVE-ID: CVE-2018-20467)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in coders/bmp.c. A remote attacker can trick the victim into opening a specially crafted file, consume all available system resources and cause denial of service conditions.
4) Memory leak (CVE-ID: CVE-2019-7175)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the DecodeImage() function in coders/pcd.c. A remote attacker can create a specially crafted image file and perform denial of service attack.
5) Memory leak (CVE-ID: CVE-2019-7395)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WritePSDChannel function, as defined in the coders/psd.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
6) Memory leak (CVE-ID: CVE-2019-7396)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the ReadSIXELImage function, as defined in the coders/sixel.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
7) Memory leak (CVE-ID: CVE-2019-7397)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WritePDFImage function, as defined in the coders/pdf.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
8) Memory leak (CVE-ID: CVE-2019-7398)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due a memory leak in the WriteDIBImage function, as defined in the coders/dib.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.
Remediation
Install update from vendor's website.