Vulnerabilities > CVE-2018-18544 - Missing Release of Resource after Effective Lifetime vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL

Summary

There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.

Vulnerable Configurations

Part Description Count
Application
Graphicsmagick
64
Application
Imagemagick
1
OS
Opensuse
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • HTTP DoS
    An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1010.NASL
    descriptionAccording to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.(CVE-2019-11470) - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.(CVE-2018-16328) - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.(CVE-2018-15607) - The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.(CVE-2018-14551) - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.(CVE-2018-18544) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-03
    modified2020-01-02
    plugin id132603
    published2020-01-02
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132603
    titleEulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1010)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132603);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/01");
    
      script_cve_id(
        "CVE-2018-14551",
        "CVE-2018-15607",
        "CVE-2018-16328",
        "CVE-2018-18544",
        "CVE-2019-11470"
      );
    
      script_name(english:"EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1010)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the ImageMagick packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The cineon parsing component in ImageMagick 7.0.8-26
        Q16 allows attackers to cause a denial-of-service
        (uncontrolled resource consumption) by crafting a
        Cineon image with an incorrect claimed image size. This
        occurs because ReadCINImage in coders/cin.c lacks a
        check for insufficient image data in a
        file.(CVE-2019-11470)
    
      - In ImageMagick before 7.0.8-8, a NULL pointer
        dereference exists in the CheckEventLogging function in
        MagickCore/log.c.(CVE-2018-16328)
    
      - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50
        0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36
        0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of
        several minutes during which CPU and memory resources
        are consumed until ultimately an attempted large memory
        allocation fails. Remote attackers could leverage this
        vulnerability to cause a denial of service via a
        crafted file.(CVE-2018-15607)
    
      - The ReadMATImageV4 function in coders/mat.c in
        ImageMagick 7.0.8-7 uses an uninitialized variable,
        leading to memory corruption.(CVE-2018-14551)
    
      - There is a memory leak in the function WriteMSLImage of
        coders/msl.c in ImageMagick 7.0.8-13 Q16, and the
        function ProcessMSLScript of coders/msl.c in
        GraphicsMagick before 1.3.31.(CVE-2018-18544)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1010
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?100a3061");
      script_set_attribute(attribute:"solution", value:
    "Update the affected ImageMagick packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/01/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/02");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ImageMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ImageMagick-c++");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ImageMagick-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ImageMagick-perl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(8)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);
    
    flag = 0;
    
    pkgs = ["ImageMagick-6.9.9.38-3.h11.eulerosv2r8",
            "ImageMagick-c++-6.9.9.38-3.h11.eulerosv2r8",
            "ImageMagick-libs-6.9.9.38-3.h11.eulerosv2r8",
            "ImageMagick-perl-6.9.9.38-3.h11.eulerosv2r8"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"8", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1430.NASL
    descriptionThis update for GraphicsMagick fixes the following issues : Security issue fixed : - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage of coders/msl.c (bsc#1113064). Non-security issues fixed : - asan_build: build ASAN included - debug_build: build more suitable for debugging
    last seen2020-06-05
    modified2018-11-21
    plugin id119080
    published2018-11-21
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119080
    titleopenSUSE Security Update : GraphicsMagick (openSUSE-2018-1430)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2018-1430.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119080);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-18544");
    
      script_name(english:"openSUSE Security Update : GraphicsMagick (openSUSE-2018-1430)");
      script_summary(english:"Check for the openSUSE-2018-1430 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for GraphicsMagick fixes the following issues :
    
    Security issue fixed :
    
      - CVE-2018-18544: Fixed memory leak in the function
        WriteMSLImage of coders/msl.c (bsc#1113064).
    
    Non-security issues fixed :
    
      - asan_build: build ASAN included
    
      - debug_build: build more suitable for debugging"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1113064"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected GraphicsMagick packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:GraphicsMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:GraphicsMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:GraphicsMagick-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:GraphicsMagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick++-Q16-12");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick++-Q16-12-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick-Q16-3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick-Q16-3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagick3-config");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagickWand-Q16-2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libGraphicsMagickWand-Q16-2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-GraphicsMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-GraphicsMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.3", reference:"GraphicsMagick-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"GraphicsMagick-debuginfo-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"GraphicsMagick-debugsource-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"GraphicsMagick-devel-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick++-Q16-12-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick++-Q16-12-debuginfo-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick++-devel-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick-Q16-3-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick-Q16-3-debuginfo-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagick3-config-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagickWand-Q16-2-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"perl-GraphicsMagick-1.3.25-117.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"perl-GraphicsMagick-debuginfo-1.3.25-117.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "GraphicsMagick / GraphicsMagick-debuginfo / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1141.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). - CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage (bsc#1113064). - CVE-2018-20467: Fixed an infinite loop in coders/bmp.c (bsc#1120381). - CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). - CVE-2019-7396: Fixed a memory leak in the function ReadSIXELImage (bsc#1124367). - CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). - CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). - CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996). Non-security issue fixed : - Fixed a regression in regards to the
    last seen2020-06-01
    modified2020-06-02
    plugin id123771
    published2019-04-05
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123771
    titleopenSUSE Security Update : ImageMagick (openSUSE-2019-1141)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200407_IMAGEMAGICK_ON_SL7_X.NASL
    description* ImageMagick: multiple security vulnerabilities
    last seen2020-04-30
    modified2020-04-21
    plugin id135797
    published2020-04-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135797
    titleScientific Linux Security Update : ImageMagick on SL7.x x86_64 (20200407)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1520.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage (bsc#1113064). Non-security issues fixed : - Improve import documentation (bsc#1057246). - Allow override system security policy (bsc#1117463). - asan_build: build ASAN included - debug_build: build more suitable for debugging This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2018-12-10
    plugin id119548
    published2018-12-10
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119548
    titleopenSUSE Security Update : ImageMagick (openSUSE-2018-1520)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-0739-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage (bsc#1113064). CVE-2018-20467: Fixed an infinite loop in coders/bmp.c (bsc#1120381). CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). CVE-2019-7396: Fixed a memory leak in the function ReadSIXELImage (bsc#1124367). CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996). Non-security issue fixed: Fixed a regression in regards to the
    last seen2020-06-01
    modified2020-06-02
    plugin id123410
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123410
    titleSUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2019:0739-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-4023-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18544: Fixed memory leak in the function WriteMSLImage (bsc#1113064). Non-security issues fixed: Improve import documentation (bsc#1057246). Allow override system security policy (bsc#1117463). asan_build: build ASAN included debug_build: build more suitable for debugging Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-12
    modified2018-12-10
    plugin id119556
    published2018-12-10
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119556
    titleSUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:4023-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-1180.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory. - ImageMagick: CPU exhaustion vulnerability in function ReadDDSInfo in coders/dds.c (CVE-2017-1000476) - ImageMagick: memory leak vulnerability in ReadXWDImage function in coders/xwd.c (CVE-2017-11166) - ImageMagick: memory exhaustion in function ReadTIFFImage causing denial of service (CVE-2017-12805) - ImageMagick: memory exhaustion in function format8BIM causing denial of service (CVE-2017-12806) - ImageMagick: memory leak in ReadPCDImage function in coders/pcd.c (CVE-2017-18251) - ImageMagick: assertion failure in MogrifyImageList function in MagickWand/mogrify.c (CVE-2017-18252) - ImageMagick: memory leak in WriteGIFImage function in coders/gif.c (CVE-2017-18254) - ImageMagick: infinite loop in ReadMIFFImage function in coders/miff.c (CVE-2017-18271) - ImageMagick: infinite loop ReadTXTImage in function in coders/txt.c (CVE-2017-18273) - ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file (CVE-2018-10177) - ImageMagick: Memory leak in WriteTIFFImage (CVE-2018-10804) - ImageMagick: Memory leak in ReadYCBCRImage (CVE-2018-10805) - ImageMagick: memory leak in ReadDCMImage function in coders/dcm.c (CVE-2018-11656) - ImageMagick: out of bounds write in ReadBMPImage and WriteBMPImage in coders/bmp.c (CVE-2018-12599) - ImageMagick: out of bounds write ReadDIBImage and WriteDIBImage in coders/dib.c (CVE-2018-12600) - ImageMagick: memory leak in the XMagickCommand function in MagickCore/animate.c (CVE-2018-13153) - ImageMagick: memory leak for a colormap in WriteMPCImage in coders/mpc.c (CVE-2018-14434) - ImageMagick: memory leak in DecodeImage in coders/pcd.c (CVE-2018-14435) - ImageMagick: memory leak in ReadMIFFImage in coders/miff.c (CVE-2018-14436) - ImageMagick: memory leak in parse8BIM in coders/meta.c (CVE-2018-14437) - ImageMagick: CPU Exhaustion via crafted input file (CVE-2018-15607) - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328) - ImageMagick: reachable assertion in ReadOneJNGImage in coders/png.c (CVE-2018-16749) - ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c (CVE-2018-16750) - ImageMagick: memory leak in WriteMSLImage of coders/msl.c (CVE-2018-18544) - ImageMagick: infinite loop in coders/bmp.c (CVE-2018-20467) - ImageMagick: double free in WriteEPTImage function in coders/ept.c (CVE-2018-8804) - ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c (CVE-2018-9133) - ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c (CVE-2019-10131) - ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file (CVE-2019-10650) - ImageMagick: denial of service in cineon parsing component (CVE-2019-11470) - ImageMagick: denial of service in ReadXWDImage in coders/xwd.c in the XWD image parsing component (CVE-2019-11472) - ImageMagick: heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c leading to DoS or information disclosure (CVE-2019-11597) - ImageMagick: heap-based buffer over-read in the function WritePNMImage of coders/pnm.c leading to DoS or information disclosure (CVE-2019-11598) - imagemagick: null-pointer dereference in function ReadPANGOImage in coders/pango.c and ReadVIDImage in coders/vid.c causing denial of service (CVE-2019-12974) - imagemagick: memory leak vulnerability in function WriteDPXImage in coders/dpx.c (CVE-2019-12975) - imagemagick: memory leak vulnerability in function ReadPCLImage in coders/pcl.c (CVE-2019-12976) - imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c (CVE-2019-12978) - imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c (CVE-2019-12979) - ImageMagick: a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c (CVE-2019-13133) - ImageMagick: a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c (CVE-2019-13134) - ImageMagick: a use of uninitialized value vulnerability in the function ReadCUTImage leading to a crash and DoS (CVE-2019-13135) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled (CVE-2019-13295) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled (CVE-2019-13297) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns (CVE-2019-13300) - ImageMagick: memory leaks in AcquireMagickMemory (CVE-2019-13301) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment (CVE-2019-13304) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error (CVE-2019-13305) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors (CVE-2019-13306) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows (CVE-2019-13307) - ImageMagick: memory leaks at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (CVE-2019-13309) - ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c (CVE-2019-13310) - ImageMagick: memory leaks at AcquireMagickMemory because of a wand/mogrify.c error (CVE-2019-13311) - ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c (CVE-2019-13454) - ImageMagick: use-after-free in magick/blob.c resulting in a denial of service (CVE-2019-14980) - ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c (CVE-2019-14981) - ImageMagick: out-of-bounds read in ReadXWDImage in coders/xwd.c (CVE-2019-15139) - ImageMagick: Use after free in ReadMATImage in coders/mat.c (CVE-2019-15140) - ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c (CVE-2019-15141) - ImageMagick: memory leak in magick/xwindow.c (CVE-2019-16708) - ImageMagick: memory leak in coders/dps.c (CVE-2019-16709) - ImageMagick: memory leak in coders/dot.c (CVE-2019-16710, CVE-2019-16713) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps2.c (CVE-2019-16711) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps3.c (CVE-2019-16712) - ImageMagick: heap-based buffer overflow in ReadPSInfo in coders/ps.c (CVE-2019-17540) - ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c (CVE-2019-17541) - ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c (CVE-2019-19948) - ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c (CVE-2019-19949) - imagemagick: memory leak in function DecodeImage in coders/pcd.c (CVE-2019-7175) - ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c (CVE-2019-7397) - ImageMagick: Memory leak in the WriteDIBImage function in coders/dib.c (CVE-2019-7398) - imagemagick: stack-based buffer overflow in function PopHexPixel in coders/ps.c (CVE-2019-9956) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-04-10
    plugin id135354
    published2020-04-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135354
    titleCentOS 7 : ImageMagick / autotrace / emacs / inkscape (CESA-2020:1180)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1180.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory. - ImageMagick: CPU exhaustion vulnerability in function ReadDDSInfo in coders/dds.c (CVE-2017-1000476) - ImageMagick: memory leak vulnerability in ReadXWDImage function in coders/xwd.c (CVE-2017-11166) - ImageMagick: memory exhaustion in function ReadTIFFImage causing denial of service (CVE-2017-12805) - ImageMagick: memory exhaustion in function format8BIM causing denial of service (CVE-2017-12806) - ImageMagick: memory leak in ReadPCDImage function in coders/pcd.c (CVE-2017-18251) - ImageMagick: assertion failure in MogrifyImageList function in MagickWand/mogrify.c (CVE-2017-18252) - ImageMagick: memory leak in WriteGIFImage function in coders/gif.c (CVE-2017-18254) - ImageMagick: infinite loop in ReadMIFFImage function in coders/miff.c (CVE-2017-18271) - ImageMagick: infinite loop ReadTXTImage in function in coders/txt.c (CVE-2017-18273) - ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file (CVE-2018-10177) - ImageMagick: Memory leak in WriteTIFFImage (CVE-2018-10804) - ImageMagick: Memory leak in ReadYCBCRImage (CVE-2018-10805) - ImageMagick: memory leak in ReadDCMImage function in coders/dcm.c (CVE-2018-11656) - ImageMagick: out of bounds write in ReadBMPImage and WriteBMPImage in coders/bmp.c (CVE-2018-12599) - ImageMagick: out of bounds write ReadDIBImage and WriteDIBImage in coders/dib.c (CVE-2018-12600) - ImageMagick: memory leak in the XMagickCommand function in MagickCore/animate.c (CVE-2018-13153) - ImageMagick: memory leak for a colormap in WriteMPCImage in coders/mpc.c (CVE-2018-14434) - ImageMagick: memory leak in DecodeImage in coders/pcd.c (CVE-2018-14435) - ImageMagick: memory leak in ReadMIFFImage in coders/miff.c (CVE-2018-14436) - ImageMagick: memory leak in parse8BIM in coders/meta.c (CVE-2018-14437) - ImageMagick: CPU Exhaustion via crafted input file (CVE-2018-15607) - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328) - ImageMagick: reachable assertion in ReadOneJNGImage in coders/png.c (CVE-2018-16749) - ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c (CVE-2018-16750) - ImageMagick: memory leak in WriteMSLImage of coders/msl.c (CVE-2018-18544) - ImageMagick: infinite loop in coders/bmp.c (CVE-2018-20467) - ImageMagick: double free in WriteEPTImage function in coders/ept.c (CVE-2018-8804) - ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c (CVE-2018-9133) - ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c (CVE-2019-10131) - ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file (CVE-2019-10650) - ImageMagick: denial of service in cineon parsing component (CVE-2019-11470) - ImageMagick: denial of service in ReadXWDImage in coders/xwd.c in the XWD image parsing component (CVE-2019-11472) - ImageMagick: heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c leading to DoS or information disclosure (CVE-2019-11597) - ImageMagick: heap-based buffer over-read in the function WritePNMImage of coders/pnm.c leading to DoS or information disclosure (CVE-2019-11598) - imagemagick: null-pointer dereference in function ReadPANGOImage in coders/pango.c and ReadVIDImage in coders/vid.c causing denial of service (CVE-2019-12974) - imagemagick: memory leak vulnerability in function WriteDPXImage in coders/dpx.c (CVE-2019-12975) - imagemagick: memory leak vulnerability in function ReadPCLImage in coders/pcl.c (CVE-2019-12976) - imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c (CVE-2019-12978) - imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c (CVE-2019-12979) - ImageMagick: a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c (CVE-2019-13133) - ImageMagick: a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c (CVE-2019-13134) - ImageMagick: a use of uninitialized value vulnerability in the function ReadCUTImage leading to a crash and DoS (CVE-2019-13135) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled (CVE-2019-13295) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled (CVE-2019-13297) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns (CVE-2019-13300) - ImageMagick: memory leaks in AcquireMagickMemory (CVE-2019-13301) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment (CVE-2019-13304) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error (CVE-2019-13305) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors (CVE-2019-13306) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows (CVE-2019-13307) - ImageMagick: memory leaks at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (CVE-2019-13309) - ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c (CVE-2019-13310) - ImageMagick: memory leaks at AcquireMagickMemory because of a wand/mogrify.c error (CVE-2019-13311) - ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c (CVE-2019-13454) - ImageMagick: use-after-free in magick/blob.c resulting in a denial of service (CVE-2019-14980) - ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c (CVE-2019-14981) - ImageMagick: out-of-bounds read in ReadXWDImage in coders/xwd.c (CVE-2019-15139) - ImageMagick: Use after free in ReadMATImage in coders/mat.c (CVE-2019-15140) - ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c (CVE-2019-15141) - ImageMagick: memory leak in magick/xwindow.c (CVE-2019-16708) - ImageMagick: memory leak in coders/dps.c (CVE-2019-16709) - ImageMagick: memory leak in coders/dot.c (CVE-2019-16710, CVE-2019-16713) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps2.c (CVE-2019-16711) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps3.c (CVE-2019-16712) - ImageMagick: heap-based buffer overflow in ReadPSInfo in coders/ps.c (CVE-2019-17540) - ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c (CVE-2019-17541) - ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c (CVE-2019-19948) - ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c (CVE-2019-19949) - imagemagick: memory leak in function DecodeImage in coders/pcd.c (CVE-2019-7175) - ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c (CVE-2019-7397) - ImageMagick: Memory leak in the WriteDIBImage function in coders/dib.c (CVE-2019-7398) - imagemagick: stack-based buffer overflow in function PopHexPixel in coders/ps.c (CVE-2019-9956) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-03-31
    plugin id135041
    published2020-03-31
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135041
    titleRHEL 7 : ImageMagick (RHSA-2020:1180)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1431.NASL
    descriptionThis update for GraphicsMagick fixes the following issues : Security issue fixed : - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage of coders/msl.c (bsc#1113064). Non-security issues fixed : - asan_build: build ASAN included - debug_build: build more suitable for debugging
    last seen2020-06-05
    modified2018-11-21
    plugin id119081
    published2018-11-21
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119081
    titleopenSUSE Security Update : GraphicsMagick (openSUSE-2018-1431)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-932.NASL
    descriptionThis update for GraphicsMagick fixes the following issues : Security issue fixed : - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage of coders/msl.c (bsc#1113064). Non-security issues fixed : - asan_build: build ASAN included - debug_build: build more suitable for debugging
    last seen2020-06-01
    modified2020-06-02
    plugin id123380
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123380
    titleopenSUSE Security Update : GraphicsMagick (openSUSE-2019-932)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4034-1.NASL
    descriptionIt was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick safely, the update for Ubuntu 18.10 and Ubuntu 19.04 includes a default policy change that disables support for the Postscript and PDF formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick policy configuration. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126254
    published2019-06-26
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126254
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : imagemagick vulnerabilities (USN-4034-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-13993-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). CVE-2018-18544: Fixed memory leak in the function WriteMSLImage (bsc#1113064). CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381). CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989). CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996). CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id123456
    published2019-03-28
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123456
    titleSUSE SLES11 Security Update : ImageMagick (SUSE-SU-2019:13993-1)

Redhat

rpms
  • ImageMagick-0:6.9.10.68-3.el7
  • ImageMagick-c++-0:6.9.10.68-3.el7
  • ImageMagick-c++-devel-0:6.9.10.68-3.el7
  • ImageMagick-debuginfo-0:6.9.10.68-3.el7
  • ImageMagick-devel-0:6.9.10.68-3.el7
  • ImageMagick-doc-0:6.9.10.68-3.el7
  • ImageMagick-perl-0:6.9.10.68-3.el7
  • autotrace-0:0.31.1-38.el7
  • autotrace-debuginfo-0:0.31.1-38.el7
  • autotrace-devel-0:0.31.1-38.el7
  • emacs-1:24.3-23.el7
  • emacs-common-1:24.3-23.el7
  • emacs-debuginfo-1:24.3-23.el7
  • emacs-el-1:24.3-23.el7
  • emacs-filesystem-1:24.3-23.el7
  • emacs-nox-1:24.3-23.el7
  • emacs-terminal-1:24.3-23.el7
  • inkscape-0:0.92.2-3.el7
  • inkscape-debuginfo-0:0.92.2-3.el7
  • inkscape-docs-0:0.92.2-3.el7
  • inkscape-view-0:0.92.2-3.el7