SUSE-SU-2019:1033-1
- Source
- https://www.suse.com/support/update/announcement/2019/suse-su-20191033-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2019:1033-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2019:1033-1
- Related
- Published
- 2019-04-25T10:47:46Z
- Modified
- 2019-04-25T10:47:46Z
- Summary
- Security update for ImageMagick
- Details
-
This update for ImageMagick fixes the following issues:
Security issues fixed:
- CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330).
- CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317).
- CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649).
- CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381).
- CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365).
- CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366).
- CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368).
- CVE-2018-16413: Fixed a heap-based buffer over-read in PushShortPixel() (bsc#1106989).
- CVE-2018-16412: Fixed a heap-based buffer over-read in ParseImageResourceBlocks() (bsc#1106996).
- CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609).
- CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060).
- CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054).
CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053).
Added extra -config- packages with Postscript/EPS/PDF readers still enabled.
Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033)
These are two packages that can be selected:
- ImageMagick-config-6-SUSE: This has the PS decoders disabled.
- ImageMagick-config-6-upstream: This has the PS decoders enabled.
Depending on your local needs install either one of them. The default is the -SUSE configuration.
- References
-
- https://www.suse.com/support/update/announcement/2019/suse-su-20191033-1/
- https://bugzilla.suse.com/1106989
- https://bugzilla.suse.com/1106996
- https://bugzilla.suse.com/1107609
- https://bugzilla.suse.com/1120381
- https://bugzilla.suse.com/1122033
- https://bugzilla.suse.com/1124365
- https://bugzilla.suse.com/1124366
- https://bugzilla.suse.com/1124368
- https://bugzilla.suse.com/1128649
- https://bugzilla.suse.com/1130330
- https://bugzilla.suse.com/1131317
- https://bugzilla.suse.com/1132053
- https://bugzilla.suse.com/1132054
- https://bugzilla.suse.com/1132060
- https://www.suse.com/security/cve/CVE-2018-16412
- https://www.suse.com/security/cve/CVE-2018-16413
- https://www.suse.com/security/cve/CVE-2018-16644
- https://www.suse.com/security/cve/CVE-2018-20467
- https://www.suse.com/security/cve/CVE-2019-10650
- https://www.suse.com/security/cve/CVE-2019-11007
- https://www.suse.com/security/cve/CVE-2019-11008
- https://www.suse.com/security/cve/CVE-2019-11009
- https://www.suse.com/security/cve/CVE-2019-7175
- https://www.suse.com/security/cve/CVE-2019-7395
- https://www.suse.com/security/cve/CVE-2019-7397
- https://www.suse.com/security/cve/CVE-2019-7398
- https://www.suse.com/security/cve/CVE-2019-9956
Affected packages
SUSE:OpenStack Cloud 7 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20OpenStack%20Cloud%207
SUSE:Linux Enterprise Desktop 12 SP3 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.8.8.1-71.108.1
Ecosystem specific
{
"binaries": [
{
"libMagick++-6_Q16-3": "6.8.8.1-71.108.1",
"ImageMagick": "6.8.8.1-71.108.1",
"libMagickWand-6_Q16-1": "6.8.8.1-71.108.1",
"ImageMagick-config-6-SUSE": "6.8.8.1-71.108.1",
"ImageMagick-config-6-upstream": "6.8.8.1-71.108.1",
"libMagickCore-6_Q16-1": "6.8.8.1-71.108.1",
"libMagickCore-6_Q16-1-32bit": "6.8.8.1-71.108.1"
}
]
}
SUSE:Linux Enterprise Desktop 12 SP4 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.8.8.1-71.108.1
Ecosystem specific
{
"binaries": [
{
"libMagick++-6_Q16-3": "6.8.8.1-71.108.1",
"ImageMagick": "6.8.8.1-71.108.1",
"libMagickWand-6_Q16-1": "6.8.8.1-71.108.1",
"ImageMagick-config-6-SUSE": "6.8.8.1-71.108.1",
"ImageMagick-config-6-upstream": "6.8.8.1-71.108.1",
"libMagickCore-6_Q16-1": "6.8.8.1-71.108.1",
"libMagickCore-6_Q16-1-32bit": "6.8.8.1-71.108.1"
}
]
}
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2
SUSE:Linux Enterprise Software Development Kit 12 SP3 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3
SUSE:Linux Enterprise Software Development Kit 12 SP4 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4
SUSE:Linux Enterprise Server 12-LTSS / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS
SUSE:Linux Enterprise Server 12 SP1-LTSS / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS
SUSE:Linux Enterprise Server 12 SP2-LTSS / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS
SUSE:Linux Enterprise Server 12 SP2-BCL / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL
SUSE:Linux Enterprise Server 12 SP3 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3
SUSE:Linux Enterprise Server 12 SP4 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4
SUSE:Linux Enterprise Workstation Extension 12 SP3 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3
SUSE:Linux Enterprise Workstation Extension 12 SP4 / ImageMagick
Package
- Name
- ImageMagick
- Purl
- purl:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP4