Security Update for GraphicsMagick
Summary
DLA-1154-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u12. Fixed in 1.3.16-1.1+deb7u12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphicsMagick is an open-source image processing software suite that is used to create, edit, and convert bitmap images. It provides a wide range of functionality for manipulating images, including reading, writing, and modifying various image formats. GraphicsMagick is vulnerable to multiple security issues that could allow remote attackers to conduct use-after-free attacks, cause denial of service, and trigger NULL pointer dereferences.
Vulnerability Detail
The vulnerabilities in GraphicsMagick include:
-
CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c do not properly manage image pointers after certain error conditions, allowing remote attackers to conduct use-after-free attacks.
-
CVE-2017-14314: An off-by-one error in the DrawImage function in magick/render.c allows remote attackers to cause a denial of service by triggering a heap-based buffer over-read and application crash.
-
CVE-2017-14504: ReadPNMImage in coders/pnm.c does not ensure the correct number of colors for the XV 332 format, leading to a NULL Pointer Dereference.
-
CVE-2017-14733: ReadRLEImage in coders/rle.c mishandles RLE headers that specify too few colors, causing a heap-based buffer over-read and application crash.
-
CVE-2017-14994: ReadDCMImage in coders/dcm.c allows remote attackers to cause a denial of service by triggering a NULL pointer dereference.
-
CVE-2017-14997: GraphicsMagick allows remote attackers to cause a denial of service due to an integer underflow in ReadPICTImage in coders/pict.c.
-
CVE-2017-15930: In ReadOneJNGImage in coders/png.c, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
GraphicsMagick is vulnerable to multiple security issues that can be exploited by remote attackers. To mitigate these vulnerabilities, it is crucial to upgrade the GraphicsMagick packages to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
GraphicsMagick is an open-source image processing software suite that allows users to create, edit, and convert bitmap images.
The vulnerabilities in GraphicsMagick include use-after-free attacks, denial of service, and NULL pointer dereferences.
These vulnerabilities can be exploited by remote attackers through crafted files or images, causing various issues such as crashes or excessive memory allocation.
To fix these vulnerabilities, it is recommended to upgrade your GraphicsMagick packages to the latest version.
No specific workarounds have been mentioned for these vulnerabilities. It is best to apply the recommended fix by upgrading the GraphicsMagick packages.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
