GraphicsMagick - Heap Buffer Overflow and Heap Overflow Vulnerabilities
Summary
DLA-651-1: graphicsmagick - security update. Affects graphicsmagick versions < 1.3.16-1.1+deb7u4. Fixed in 1.3.16-1.1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphicsMagick is an open-source image processing library that allows users to manipulate and convert images. It provides a set of command-line tools and programming APIs for various programming languages. GraphicsMagick is widely used in applications that require image manipulation and processing capabilities.
Vulnerability Detail
The vulnerability in GraphicsMagick is caused by multiple security issues, including heap buffer overflow and heap overflow vulnerabilities. These vulnerabilities can be exploited by an attacker to execute arbitrary code or cause a denial of service. The specific vulnerabilities include:
- CVE-2016-7446: Heap buffer overflow issue in MVG/SVG rendering.
- CVE-2016-7447: Heap overflow of the EscapeParenthesis() function.
- CVE-2016-7449: TIFF related problems due to the use of strlcpy.
- CVE-2016-7800: Unsigned underflow leading to a heap overflow when parsing 8BIM chunk.
How To Fix
Minimum fixed version
1.3.16-1.1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphicsmagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
GraphicsMagick is affected by multiple vulnerabilities, including heap buffer overflow and heap overflow issues. To mitigate these vulnerabilities, it is crucial to upgrade the GraphicsMagick package to the fixed version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for graphicsmagick →
FAQ
GraphicsMagick is an open-source image processing library used for manipulating and converting images.
The vulnerabilities in GraphicsMagick include heap buffer overflow and heap overflow issues, which can be exploited to execute arbitrary code or cause a denial of service.
To fix the vulnerabilities, you should upgrade the GraphicsMagick package to version 1.3.16-1.1+deb7u4 or later.
No, there are no known workarounds for these vulnerabilities. It is recommended to upgrade the package to the fixed version.
You can find more information about Debian LTS security advisories on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for graphicsmagick.
