SB2025103197 - openEuler 24.03 LTS SP2 update for ImageMagick

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2025-62171)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an integer overflow in coders/bmp.c caused by an incomplete fox for #VU114417 (CVE-2025-57803). A remote attacker can pass specially crafted image to the application, trigger an integer overflow and perform a denial of service (DoS) attack.

The vulnerability affects only 32-bit systems with certain resource limits. 

2) Integer underflow (CVE-ID: CVE-2025-62594)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer underflow in the CLAHEImage() function within MagickCore/enhance.c. A remote attacker can send a specially crafted request to the affected application, trigger integer underflow and cause a denial of service condition on the target system.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-2588