SUSE-SU-2017:3056-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3056-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2017:3056-1
Related
Published
2017-11-23T16:15:37Z
Modified
2017-11-23T16:15:37Z
Summary
Security update for GraphicsMagick
Details

This update for GraphicsMagick fixes the following issues:

  • CVE-2017-15033: A denial of service attack (memory leak) in ReadYUVImage in coders/yuv.c was fixed (bsc#1061873)
  • CVE-2017-13063: A heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c was fixed (bsc#1055050)
  • CVE-2017-13064: A heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c was fixed (bsc#1055042)
  • CVE-2017-12936: The ReadWMFImage function in coders/wmf.c in GraphicsMagick had a use-after-free issue for data associated with exception reporting. (bsc#1054598)
  • CVE-2017-13139: The ReadOneMNGImage function in coders/png.c had an out-of-bounds read with the MNG CLIP chunk. (bsc#1055430)
  • CVE-2017-12937: The ReadSUNImage function in coders/sun.c in GraphicsMagick had a colormap heap-based buffer over-read. (bsc#1054596)
  • CVE-2017-11534: A Memory Leak in the litefontmap() function in coders/wmf.c was fixed (bsc#1050135)
References

Affected packages

SUSE:Linux Enterprise Software Development Kit 11 SP4 / GraphicsMagick

Package

Name
GraphicsMagick
Purl
purl:rpm/suse/GraphicsMagick&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-4.78.16.1

Ecosystem specific 

{
    "binaries": [
        {
            "perl-GraphicsMagick": "1.2.5-4.78.16.1",
            "GraphicsMagick": "1.2.5-4.78.16.1",
            "libGraphicsMagick2": "1.2.5-4.78.16.1"
        }
    ]
}

SUSE:Studio Onsite 1.3 / GraphicsMagick

Package

Name
GraphicsMagick
Purl
purl:rpm/suse/GraphicsMagick&distro=SUSE%20Studio%20Onsite%201.3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.5-4.78.16.1

Ecosystem specific 

{
    "binaries": [
        {
            "GraphicsMagick": "1.2.5-4.78.16.1",
            "libGraphicsMagick2": "1.2.5-4.78.16.1"
        }
    ]
}