USN-5190-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-5190-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5190-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-5190-1

Related

Published

2022-08-30T16:03:50.762055Z

Modified

2022-08-30T16:03:50.762055Z

Summary

graphicsmagick vulnerabilities

Details

It was discovered that GraphicsMagick allowed reading arbitrary files via specially crafted images. An attacker could use this issue to expose sensitive information. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2019-12921)

It was discovered that GraphicsMagick did not correctly handle memory allocations for error messages. An attacker could use this issue to corrupt memory or possibly execute arbitrary code. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2019-19950)

It was discovered that GraphicsMagick did not correctly handle type limits. An attacker could use these issues to cause heap-based buffer overflows, leading to a denial of service (application crash) or possibly execute arbitrary code. These issues only affect Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2019-19951, CVE-2019-19953)

It was discovered that GraphicsMagick did not correctly handle the signed integer limit in 32-bit applications. An attacker could use this issue to cause a heap-based buffer overflow, leading to a denial of service (application crash) or possibly execute arbitrary code. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2020-10938)

It was discovered that GraphicsMagick did not properly magnify certain images. An attacker could use this issue to cause a heap-based buffer overflow, leading to a denial of service (application crash) or possibly execute arbitrary code. (CVE-2020-12672)

References

Affected packages

Ubuntu:Pro:14.04:LTS / graphicsmagick

Package

Name: graphicsmagick
Purl: pkg:deb/ubuntu/graphicsmagick?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.18-1ubuntu3.1+esm7

Affected versions

1.*

1.3.16-1.1ubuntu2

1.3.16-1.1ubuntu3

1.3.18-1ubuntu3

1.3.18-1ubuntu3.1

1.3.18-1ubuntu3.1+esm1

1.3.18-1ubuntu3.1+esm2

1.3.18-1ubuntu3.1+esm3

1.3.18-1ubuntu3.1+esm4

1.3.18-1ubuntu3.1+esm5

1.3.18-1ubuntu3.1+esm6

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "graphicsmagick"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "graphicsmagick-dbg"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "graphicsmagick-dbgsym"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "graphicsmagick-imagemagick-compat"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "graphicsmagick-libmagick-dev-compat"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphics-magick-perl"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphics-magick-perl-dbgsym"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick++1-dev"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick++1-dev-dbgsym"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick++3"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick++3-dbgsym"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick1-dev"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick1-dev-dbgsym"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick3"
        },
        {
            "binary_version": "1.3.18-1ubuntu3.1+esm7",
            "binary_name": "libgraphicsmagick3-dbgsym"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / graphicsmagick

Package

Name: graphicsmagick
Purl: pkg:deb/ubuntu/graphicsmagick?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.23-1ubuntu0.6+esm1

Affected versions

1.*

1.3.21-3

1.3.23-1

1.3.23-1build1

1.3.23-1ubuntu0.1

1.3.23-1ubuntu0.1+esm1

1.3.23-1ubuntu0.2

1.3.23-1ubuntu0.3

1.3.23-1ubuntu0.4

1.3.23-1ubuntu0.5

1.3.23-1ubuntu0.6

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "graphicsmagick"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "graphicsmagick-dbg"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "graphicsmagick-dbgsym"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "graphicsmagick-imagemagick-compat"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "graphicsmagick-libmagick-dev-compat"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphics-magick-perl"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphics-magick-perl-dbgsym"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick++-q16-12"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick++-q16-12-dbgsym"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick++1-dev"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick++1-dev-dbgsym"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick-q16-3"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick-q16-3-dbgsym"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick1-dev"
        },
        {
            "binary_version": "1.3.23-1ubuntu0.6+esm1",
            "binary_name": "libgraphicsmagick1-dev-dbgsym"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / graphicsmagick

Package

Name: graphicsmagick
Purl: pkg:deb/ubuntu/graphicsmagick?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.28-2ubuntu0.1+esm1

Affected versions

1.*

1.3.26-15

1.3.26-16

1.3.26-19

1.3.27-1

1.3.27-2

1.3.27-3

1.3.28-1

1.3.28-2

1.3.28-2ubuntu0.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "graphicsmagick"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "graphicsmagick-dbg"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "graphicsmagick-imagemagick-compat"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "graphicsmagick-libmagick-dev-compat"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "libgraphics-magick-perl"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "libgraphicsmagick++-q16-12"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "libgraphicsmagick++1-dev"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "libgraphicsmagick-q16-3"
        },
        {
            "binary_version": "1.3.28-2ubuntu0.1+esm1",
            "binary_name": "libgraphicsmagick1-dev"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / graphicsmagick

Package

Name: graphicsmagick
Purl: pkg:deb/ubuntu/graphicsmagick?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4+really1.3.35-1ubuntu0.1~esm1

Affected versions

1.*

1.4+really1.3.33+hg16115-1

1.4+really1.3.33+hg16115-1build1

1.4+really1.3.33+hg16117-1

1.4+really1.3.34-1

1.4+really1.3.34-2

1.4+really1.3.34+hg16181-1

1.4+really1.3.35-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "graphicsmagick"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "graphicsmagick-dbg"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "graphicsmagick-imagemagick-compat"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "graphicsmagick-libmagick-dev-compat"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "libgraphics-magick-perl"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "libgraphicsmagick++-q16-12"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "libgraphicsmagick++1-dev"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "libgraphicsmagick-q16-3"
        },
        {
            "binary_version": "1.4+really1.3.35-1ubuntu0.1~esm1",
            "binary_name": "libgraphicsmagick1-dev"
        }
    ]
}