graphicsmagick vulnerabilities · Page 4

CVE-2017-13648

In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.

CVE-2017-13147

In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.

• Update to 1.3.18-1ubuntu3.1+esm1

CVE-2017-13134

In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-13066

GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.

CVE-2017-13065

GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-13064

GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:311:12.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-13063

GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:314:12.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-12937

The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-12936

The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-12935

The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-11643

GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-11642

GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-11641

GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-11638

GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642.

• Update to 1.3.18-1ubuntu3.1+esm3

CVE-2017-11637

GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.

• Update to 1.3.18-1ubuntu3.1+esm2

CVE-2017-11636

GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.

• Update to 1.3.18-1ubuntu3.1+esm2

CVE-2017-11403

The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file.

• Update to 1.3.18-1ubuntu3.1+esm2

CVE-2017-11140

The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.

• Update to 1.3.18-1ubuntu3.1+esm2

CVE-2017-11102

The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (application crash) during JNG reading via a zero-length color_image data structure.

• Update to 1.3.18-1ubuntu3.1+esm2

CVE-2017-10800

When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object is larger than the actual amount of data.