Vulnerabilities > CVE-2012-3437 - Denial of Service vulnerability in Imagemagick 6.7.86
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 |
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2012-11746.NASL description Fix CVE-2012-3437 ImageMagick: Magick_png_malloc() size argument Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-08-28 plugin id 61684 published 2012-08-28 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/61684 title Fedora 16 : ImageMagick-6.7.0.10-6.fc16 (2012-11746) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2012-11746. # include("compat.inc"); if (description) { script_id(61684); script_version("1.9"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2012-3437"); script_bugtraq_id(54714); script_xref(name:"FEDORA", value:"2012-11746"); script_name(english:"Fedora 16 : ImageMagick-6.7.0.10-6.fc16 (2012-11746)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Fix CVE-2012-3437 ImageMagick: Magick_png_malloc() size argument Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=844101" ); # https://lists.fedoraproject.org/pipermail/package-announce/2012-August/085670.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?bf73ddab" ); script_set_attribute( attribute:"solution", value:"Update the affected ImageMagick package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:ImageMagick"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:16"); script_set_attribute(attribute:"patch_publication_date", value:"2012/08/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/28"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^16([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 16.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC16", reference:"ImageMagick-6.7.0.10-6.fc16")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick"); }
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2012-160.NASL description A vulnerability has been found and corrected in imagemagick : The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation (CVE-2012-3437). The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 62446 published 2012-10-06 reporter This script is Copyright (C) 2012-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/62446 title Mandriva Linux Security Advisory : imagemagick (MDVSA-2012:160) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2012:160. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(62446); script_version("1.7"); script_cvs_date("Date: 2019/08/02 13:32:54"); script_cve_id("CVE-2012-3437"); script_bugtraq_id(54714); script_xref(name:"MDVSA", value:"2012:160"); script_name(english:"Mandriva Linux Security Advisory : imagemagick (MDVSA-2012:160)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "A vulnerability has been found and corrected in imagemagick : The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation (CVE-2012-3437). The updated packages have been patched to correct this issue." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-desktop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmagick-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmagick4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:perl-Image-Magick"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2011"); script_set_attribute(attribute:"patch_publication_date", value:"2012/10/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/06"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK2011", reference:"imagemagick-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", reference:"imagemagick-desktop-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", reference:"imagemagick-doc-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64magick-devel-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64magick4-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libmagick-devel-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libmagick4-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2011", reference:"perl-Image-Magick-6.7.0.9-1.2-mdv2011.0", yank:"mdv")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2013-092.NASL description Updated imagemagick packages fix security vulnerability : The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8-6 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation (CVE-2012-3437). last seen 2020-06-01 modified 2020-06-02 plugin id 66104 published 2013-04-20 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66104 title Mandriva Linux Security Advisory : imagemagick (MDVSA-2013:092) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2013:092. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(66104); script_version("1.6"); script_cvs_date("Date: 2019/08/02 13:32:55"); script_cve_id("CVE-2012-3437"); script_bugtraq_id(54714); script_xref(name:"MDVSA", value:"2013:092"); script_xref(name:"MGASA", value:"2012-0243"); script_name(english:"Mandriva Linux Security Advisory : imagemagick (MDVSA-2013:092)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated imagemagick packages fix security vulnerability : The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8-6 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation (CVE-2012-3437)." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-desktop"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:perl-Image-Magick"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:1"); script_set_attribute(attribute:"patch_publication_date", value:"2013/04/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/04/20"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"imagemagick-6.7.5.10-3.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"imagemagick-desktop-6.7.5.10-3.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", reference:"imagemagick-doc-6.7.5.10-3.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64magick-devel-6.7.5.10-3.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64magick5-6.7.5.10-3.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"perl-Image-Magick-6.7.5.10-3.1.mbs1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-251.NASL description ImageMagick received fixes for a overflow in *png_malloc functions. (CVE-2012-3437) last seen 2020-06-05 modified 2014-06-13 plugin id 74943 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74943 title openSUSE Security Update : ImageMagick (openSUSE-SU-2013:0535-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2013-251. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(74943); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2012-3437"); script_name(english:"openSUSE Security Update : ImageMagick (openSUSE-SU-2013:0535-1)"); script_summary(english:"Check for the openSUSE-2013-251 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "ImageMagick received fixes for a overflow in *png_malloc functions. (CVE-2012-3437)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=773612" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2013-03/msg00101.html" ); script_set_attribute( attribute:"solution", value:"Update the affected ImageMagick packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-devel-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-extra"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-extra-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-PerlMagick"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-PerlMagick-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3"); script_set_attribute(attribute:"patch_publication_date", value:"2013/03/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE12\.1|SUSE12\.2|SUSE12\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1 / 12.2 / 12.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-debugsource-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-devel-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-extra-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-extra-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagick++-devel-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagick++5-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagick++5-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagickCore5-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagickCore5-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagickWand5-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"libMagickWand5-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"perl-PerlMagick-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", reference:"perl-PerlMagick-debuginfo-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"ImageMagick-devel-32bit-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickCore5-32bit-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickCore5-debuginfo-32bit-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickWand5-32bit-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickWand5-debuginfo-32bit-6.7.2.7-5.8.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-debugsource-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-devel-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-extra-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"ImageMagick-extra-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagick++-devel-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagick++5-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagick++5-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagickCore5-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagickCore5-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagickWand5-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"libMagickWand5-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"perl-PerlMagick-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", reference:"perl-PerlMagick-debuginfo-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"ImageMagick-devel-32bit-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libMagickCore5-32bit-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libMagickCore5-debuginfo-32bit-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libMagickWand5-32bit-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libMagickWand5-debuginfo-32bit-6.7.6.9-2.4.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-debugsource-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-devel-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-extra-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"ImageMagick-extra-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagick++-devel-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagick++5-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagick++5-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagickCore5-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagickCore5-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagickWand5-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libMagickWand5-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"perl-PerlMagick-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"perl-PerlMagick-debuginfo-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"ImageMagick-devel-32bit-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libMagickCore5-32bit-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libMagickCore5-debuginfo-32bit-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libMagickWand5-32bit-6.7.8.8-4.5.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libMagickWand5-debuginfo-32bit-6.7.8.8-4.5.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DLA-242.NASL description This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats. Most of those potential security problems do not have a CVE number assigned. While the security implications of all of these problems are not all fully known, it is highly recommended to update. The update fixes the following identified vulnerabilities : CVE-2012-3437 Incorrect validation of PNG buffer size, leading to DoS using specially crafted PNG files. CVE-2014-8354 Out of bounds memory access in resize CVE-2014-8355 Buffer overflow in PCX reader CVE-2014-8562 Buffer overflow in DCM readers NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-06-12 plugin id 84130 published 2015-06-12 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84130 title Debian DLA-242-1 : imagemagick security update NASL family Fedora Local Security Checks NASL id FEDORA_2012-11762.NASL description Fix CVE-2012-3437 ImageMagick: Magick_png_malloc() size argument Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2012-08-28 plugin id 61685 published 2012-08-28 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/61685 title Fedora 17 : ImageMagick-6.7.5.6-4.fc17 (2012-11762) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1544-1.NASL description Tom Lane discovered that ImageMagick would not always properly allocate memory. If a user or automated system using ImageMagick were tricked into opening a specially crafted PNG image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 61642 published 2012-08-23 reporter Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/61642 title Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : imagemagick vulnerability (USN-1544-1)
References
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00101.html
- http://secunia.com/advisories/50091
- http://secunia.com/advisories/50398
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:160
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:092
- http://www.securityfocus.com/bid/54714
- http://www.securitytracker.com/id?1027321
- http://www.ubuntu.com/usn/USN-1544-1
- https://bugzilla.redhat.com/show_bug.cgi?id=844101
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77260
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0243