Security Update for graphicsmagick
Summary
DLA-1130-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u10. Fixed in 1.3.16-1.1+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
graphicsmagick is an open-source image processing library that provides a set of command-line tools and programming APIs for manipulating images. It is widely used in various applications and frameworks to perform tasks such as image resizing, cropping, and format conversion. However, several security vulnerabilities have been discovered in graphicsmagick, which could potentially be exploited by attackers to execute arbitrary code, cause denial of service, or disclose sensitive information.
Vulnerability Detail
The security vulnerabilities in graphicsmagick include:
-
CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c did not properly manage image pointers after certain error conditions.
-
CVE-2017-14314: Heap-based buffer over-read in DrawDashPolygon().
-
CVE-2017-14504: NULL pointer dereference triggered by malformed file.
-
CVE-2017-14733: Ensure we detect alpha images with too few colors.
-
CVE-2017-14994: DCM_ReadNonNativeImages() can produce an image list with no frames, resulting in a null image pointer.
-
CVE-2017-14997: Unsigned underflow leading to an astonishingly large allocation request.
These vulnerabilities can be exploited by specially crafted image files or input data, leading to various security issues such as crashes, information leaks, or remote code execution.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
graphicsmagick is prone to multiple security vulnerabilities that could be exploited by attackers to compromise systems. It is crucial to upgrade to the latest version of graphicsmagick to mitigate these risks. If you need further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
graphicsmagick is an open-source image processing library and set of command-line tools used for manipulating images.
These vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to upgrade to the latest version of graphicsmagick as soon as possible.
You can find more information about these vulnerabilities in the Debian LTS security advisories and the related CVE links provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
