Security Update for graphicsmagick
Summary
DLA-1082-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u9. Fixed in 1.3.16-1.1+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
graphicsmagick is a powerful open-source image processing library that provides a wide range of functionality for manipulating images. It is widely used in various applications and platforms. However, several vulnerabilities have been discovered in graphicsmagick that could potentially be exploited by attackers to cause denial of service or execute arbitrary code.
Vulnerability Detail
The vulnerabilities in graphicsmagick include:
-
CVE-2017-13776 and CVE-2017-13777: These vulnerabilities allow for a denial of service attack in the ReadXBMImage() function.
-
CVE-2017-12935: This vulnerability in the ReadMNGImage function can lead to an invalid memory read and potential code execution.
-
CVE-2017-12936: The ReadWMFImage function has a use-after-free issue that can be exploited for arbitrary code execution.
-
CVE-2017-12937: The ReadSUNImage function has a heap-based buffer over-read issue that can be exploited for arbitrary code execution.
-
CVE-2017-13063 and CVE-2017-13064: These vulnerabilities in the GetStyleTokens function and SVGStartElement function respectively can lead to heap-based buffer overflow and potential code execution.
-
CVE-2017-13065: This vulnerability in the SVGStartElement function can result in a NULL pointer dereference and potential code execution.
These vulnerabilities pose a significant risk to systems using graphicsmagick and should be addressed immediately.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
graphicsmagick is prone to multiple vulnerabilities that can be exploited by attackers to cause denial of service or execute arbitrary code. It is crucial to update graphicsmagick to the latest version to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
graphicsmagick is an open-source image processing library that provides various functions for manipulating images.
The vulnerabilities in graphicsmagick include denial of service issues, invalid memory read, use-after-free issues, heap-based buffer over-read, and heap-based buffer overflow vulnerabilities.
These vulnerabilities can be exploited by attackers to cause denial of service or execute arbitrary code on systems using graphicsmagick.
To fix these vulnerabilities, it is recommended to upgrade graphicsmagick to version 1.3.16-1.1+deb7u9 or later.
More information about these vulnerabilities can be found in the Debian LTS security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
