SB2019062530 - Ubuntu update for imagemagick

Description

This security bulletin contains information about 30 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2018-18544)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak in the WriteMSLImage function, as defined in the coders/msl.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input, trigger memory leak and cause the service to crash.

2) Stack-based buffer overflow (CVE-ID: CVE-2019-9956)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a crafted image file in the PopHexPixel() function of coders/ps.c. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Memory leak (CVE-ID: CVE-2019-7398)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a memory leak in the WriteDIBImage function, as defined in the coders/dib.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.

4) Memory leak (CVE-ID: CVE-2019-7397)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a memory leak in the WritePDFImage function, as defined in the coders/pdf.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.

5) Memory leak (CVE-ID: CVE-2019-7396)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a memory leak in the ReadSIXELImage function, as defined in the coders/sixel.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.

6) Memory leak (CVE-ID: CVE-2019-7395)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due a memory leak in the WritePSDChannel function, as defined in the coders/psd.c source code file. A remote attacker can trick the victim into accessing a file that submits malicious input and perform denial of service attack.

7) Memory leak (CVE-ID: CVE-2019-7175)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the DecodeImage() function in coders/pcd.c. A remote attacker can create a specially crafted image file and perform denial of service attack.

8) Out-of-bounds read (CVE-ID: CVE-2019-11598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access sensitive information or cause a denial of service (DoS) condition.

The vulnerability exists due to a boundary condition in the "WritePNMImage()" function in the "coders/pnm.c" file. A remote attacker can send a specially crafted image file (related to SetGrayscaleImage in MagickCore/quantize.c.), trick the victim into opening it, trigger out-of-bounds read error, get access to sensitive information or cause a DoS condition on the targeted system.

9) Out-of-bounds read (CVE-ID: CVE-2019-11597)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. A remote attacker can perform a denial of service attack.

10) Division by zero (CVE-ID: CVE-2019-11472)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.

11) Resource exhaustion (CVE-ID: CVE-2019-11470)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a lack of checks for insufficient image data in a file in the "ReadCINImage()" function, as defined in the "coders/cin.c" file. A remote attacker can send a specially crafted Cineon image with an incorrect claimed image size, trick a user into opening it, trigger resource exhaustion and perform a denial of service (DoS) attack.

12) Out-of-bounds read (CVE-ID: CVE-2019-10650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the WriteTIFFImage() function in coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. A remote attacker can perform a denial of service attack.

13) Memory leak (CVE-ID: CVE-2019-10649)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file. A remote attacker can perform a denial of service attack.

14) Off-by-one (CVE-ID: CVE-2019-10131)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to an off-by-one read error in the formatIPTCfromBuffer function in coders/meta.c. A remote attacker can pass specially crafted image file the to affected application, trigger an off-by-one read error and perform denial of service attack.

15) Infinite loop (CVE-ID: CVE-2018-20467)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in coders/bmp.c. A remote attacker can trick the victim into opening a specially crafted file, consume all available system resources and cause denial of service conditions.

16) Resource exhaustion (CVE-ID: CVE-2017-12805)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a memory consumption condition in the "ReadTIFFImage()" function. A remote attacker can send a specially crafted file to the targeted system, trigger resource exhaustion and perform a denial of service (DoS) attack.

17) Out-of-bounds read (CVE-ID: CVE-2018-18025)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file. A remote attacker can perform a denial of service attack.

18) Infinite loop (CVE-ID: CVE-2018-18024)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the function ReadBMPImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted bmp file.

19) Out-of-bounds read (CVE-ID: CVE-2018-18023)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file. A remote attacker can perform a denial of service attack.

20) Memory leak (CVE-ID: CVE-2018-18016)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the function WritePCXImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted file.

21) Memory leak (CVE-ID: CVE-2018-17966)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the function WritePDBImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted file.

22) Memory leak (CVE-ID: CVE-2018-17965)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the function WriteSGIImage in coders/sgi.c. A remote attacker can perform a denial of service attack via a specially crafted file.

23) Buffer overflow (CVE-ID: CVE-2018-16645)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ReadBMPImage() function in coders/bmp.c and in ReadDIBImage() function in coders/dib.c. A remote attacker can create a specially crafted image, pass it to the affected application and trigger application crash due to memory allocation error.

24) Input validation error (CVE-ID: CVE-2018-16644)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient check for length in ReadDCMImage() function in coders/dcm.c and in ReadPICTImage() function in coders/pict.c. A remote attacker can pass a specially crafted image to the affected application and trigger application crash.

25) Buffer over-read (CVE-ID: CVE-2018-16413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a heap-based buffer over-read in the MagickCore/quantum-private.h in PushShortPixel() function when called from the coders/psd.c ParseImageResourceBlocks() function. A remote attacker can perform a denial of service attack with a specially crafted image file.

26) Buffer over-read (CVE-ID: CVE-2018-16412)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function. A remote attacker can perform a denial of service attack.

27) Information disclosure (CVE-ID: CVE-2018-16323)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.

28) Resource exhaustion (CVE-ID: CVE-2018-15607)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

29) Input validation error (CVE-ID: CVE-2018-14434)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c.

30) Resource exhaustion (CVE-ID: CVE-2017-12806)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory exhaustion when processing images within the format8BIM() function. A remote attacker can create a specially crafted image, pass it to the affected application and consume all available memory on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4034-1