Vulnerabilities > CVE-2019-9956 - Out-of-bounds Write vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
imagemagick
debian
CWE-787
nessus
NVD
Published: 2019-03-24
Updated: 2020-08-24

Summary

In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.

Vulnerable Configurations

Part Description Count
Application
Imagemagick
1
OS
Debian
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_183D700EEC70487EA9C4632324AFA934.NASL
    descriptioncvedetails.com reports : CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c. CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c. CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file. CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file. CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV. CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file. CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
    last seen2020-06-01
    modified2020-06-02
    plugin id125614
    published2019-05-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125614
    titleFreeBSD : ImageMagick -- multiple vulnerabilities (183d700e-ec70-487e-a9c4-632324afa934)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2020 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(125614);
  script_version("1.5");
  script_cvs_date("Date: 2020/01/13");

  script_cve_id("CVE-2019-10131", "CVE-2019-10649", "CVE-2019-10650", "CVE-2019-10714", "CVE-2019-11470", "CVE-2019-11472", "CVE-2019-11597", "CVE-2019-11598", "CVE-2019-7175", "CVE-2019-7395", "CVE-2019-7396", "CVE-2019-7397", "CVE-2019-7398", "CVE-2019-9956");

  script_name(english:"FreeBSD : ImageMagick -- multiple vulnerabilities (183d700e-ec70-487e-a9c4-632324afa934)");
  script_summary(english:"Checks for updated packages in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote FreeBSD host is missing one or more security-related
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"cvedetails.com reports :

CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist
in DecodeImage in coders/pcd.c.

CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in
WritePSDChannel in coders/psd.c.

CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in
ReadSIXELImage in coders/sixel.c.

CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick
through 1.3.31, several memory leaks exist in WritePDFImage in
coders/pdf.c.

CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in
WriteDIBImage in coders/dib.c.

CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based
buffer overflow in the function PopHexPixel of coders/ps.c, which
allows an attacker to cause a denial of service or code execution via
a crafted image file.

CVE-2019-10131: An off-by-one read vulnerability was discovered in
ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer
function in coders/meta.c. A local attacker may use this flaw to read
beyond the end of the buffer or to crash the program.

CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in
the function SVGKeyValuePairs of coders/svg.c, which allows an
attacker to cause a denial of service via a crafted image file.

CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based
buffer over-read in the function WriteTIFFImage of coders/tiff.c,
which allows an attacker to cause a denial of service or information
disclosure via a crafted image file.

CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick
before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.

CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26
Q16 allows attackers to cause a denial-of-service (uncontrolled
resource consumption) by crafting a Cineon image with an incorrect
claimed image size. This occurs because ReadCINImage in coders/cin.c
lacks a check for insufficient image data in a file.

CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing
component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a
denial-of-service (divide-by-zero error) by crafting an XWD image file
in which the header indicates neither LSB first nor MSB first.

CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based
buffer over-read in the function WriteTIFFImage of coders/tiff.c,
which allows an attacker to cause a denial of service or possibly
information disclosure via a crafted image file.

CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based
buffer over-read in the function WritePNMImage of coders/pnm.c, which
allows an attacker to cause a denial of service or possibly
information disclosure via a crafted image file. This is related to
SetGrayscaleImage in MagickCore/quantize.c."
  );
  # https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?1f4e659e"
  );
  # https://vuxml.freebsd.org/freebsd/183d700e-ec70-487e-a9c4-632324afa934.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?df154b9c"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9956");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick6-nox11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick7-nox11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/31");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"ImageMagick7<7.0.8.47")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ImageMagick7-nox11<7.0.8.47")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ImageMagick6<6.9.10.47,1")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ImageMagick6-nox11<6.9.10.47,1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1033-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381). CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). CVE-2018-16413: Fixed a heap-based buffer over-read in PushShortPixel() (bsc#1106989). CVE-2018-16412: Fixed a heap-based buffer over-read in ParseImageResourceBlocks() (bsc#1106996). CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609). CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053). Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected : - ImageMagick-config-6-SUSE: This has the PS decoders disabled. - ImageMagick-config-6-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124315
    published2019-04-26
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124315
    titleSUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2019:1033-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:1033-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(124315);
  script_version("1.3");
  script_cvs_date("Date: 2020/01/21");

  script_cve_id("CVE-2018-16412", "CVE-2018-16413", "CVE-2018-16644", "CVE-2018-20467", "CVE-2019-10650", "CVE-2019-11007", "CVE-2019-11008", "CVE-2019-11009", "CVE-2019-7175", "CVE-2019-7395", "CVE-2019-7397", "CVE-2019-7398", "CVE-2019-9956");

  script_name(english:"SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2019:1033-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for ImageMagick fixes the following issues :

Security issues fixed :

CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel()
(bsc#1130330).

CVE-2019-10650: Fixed a heap-based buffer over-read in
WriteTIFFImage() (bsc#1131317).

CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function
(bsc#1128649).

CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381).

CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage
(bsc#1124365).

CVE-2019-7397: Fixed a memory leak in the function WritePDFImage
(bsc#1124366).

CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel
(bsc#1124368).

CVE-2018-16413: Fixed a heap-based buffer over-read in
PushShortPixel() (bsc#1106989).

CVE-2018-16412: Fixed a heap-based buffer over-read in
ParseImageResourceBlocks() (bsc#1106996).

CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609).

CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage()
(bsc#1132060).

CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage()
(bsc#1132054).

CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage()
(bsc#1132053).

Added extra -config- packages with Postscript/EPS/PDF readers still
enabled.

Removing the PS decoders is used to harden ImageMagick against
security issues within ghostscript. Enabling them might impact
security. (bsc#1122033)

These are two packages that can be selected :

  - ImageMagick-config-6-SUSE: This has the PS decoders
    disabled.

  - ImageMagick-config-6-upstream: This has the PS decoders
    enabled.

    Depending on your local needs install either one of
    them. The default is the -SUSE configuration.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1106989"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1106996"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1107609"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1120381"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1122033"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1124365"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1124366"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1124368"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1128649"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1130330"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1131317"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1132053"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1132054"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1132060"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-16412/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-16413/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-16644/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-20467/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-10650/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-11007/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-11008/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-11009/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-7175/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-7395/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-7397/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-7398/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-9956/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20191033-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3240807e"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch
SUSE-OpenStack-Cloud-7-2019-1033=1

SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch
SUSE-SLE-WE-12-SP4-2019-1033=1

SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch
SUSE-SLE-WE-12-SP3-2019-1033=1

SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
patch SUSE-SLE-SDK-12-SP4-2019-1033=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2019-1033=1

SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
SUSE-SLE-SAP-12-SP2-2019-1033=1

SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
SUSE-SLE-SERVER-12-SP4-2019-1033=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2019-1033=1

SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2019-1033=1

SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-BCL-2019-1033=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2019-1033=1

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2019-1033=1

SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP4-2019-1033=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2019-1033=1

SUSE Enterprise Storage 4:zypper in -t patch
SUSE-Storage-4-2019-1033=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-6-SUSE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-6-upstream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-6_Q16-3-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16-1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16-1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-6_Q16-1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/04/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(0|1|2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0/1/2/3/4", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagick++-6_Q16-3-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagick++-6_Q16-3-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1019-1.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected : - ImageMagick-config-7-SUSE: This has the PS decoders disabled. - ImageMagick-config-7-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124296
    published2019-04-25
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124296
    titleSUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2019:1019-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:1019-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(124296);
  script_version("1.3");
  script_cvs_date("Date: 2020/01/22");

  script_cve_id("CVE-2019-10650", "CVE-2019-11007", "CVE-2019-11008", "CVE-2019-9956");

  script_name(english:"SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2019:1019-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for ImageMagick fixes the following issues :

Security issues fixed :

CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel()
(bsc#1130330).

CVE-2019-10650: Fixed a heap-based buffer over-read in
WriteTIFFImage() (bsc#1131317).

CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage()
(bsc#1132060).

CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage()
(bsc#1132054).

Added extra -config- packages with Postscript/EPS/PDF readers still
enabled.

Removing the PS decoders is used to harden ImageMagick against
security issues within ghostscript. Enabling them might impact
security. (bsc#1122033)

These are two packages that can be selected :

  - ImageMagick-config-7-SUSE: This has the PS decoders
    disabled.

  - ImageMagick-config-7-upstream: This has the PS decoders
    enabled.

    Depending on your local needs install either one of
    them. The default is the -SUSE configuration.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1122033"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1130330"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1131317"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1132054"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1132060"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-10650/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-11007/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-11008/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-9956/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20191019-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?71b722fc"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Open Buildservice Development Tools
15:zypper in -t patch
SUSE-SLE-Module-Development-Tools-OBS-15-2019-1019=1

SUSE Linux Enterprise Module for Development Tools 15:zypper in -t
patch SUSE-SLE-Module-Development-Tools-15-2019-1019=1

SUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t
patch SUSE-SLE-Module-Desktop-Applications-15-2019-1019=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-7-SUSE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-7-upstream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-extra-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-7_Q16HDRI4-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-7_Q16HDRI6-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-7_Q16HDRI6-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:perl-PerlMagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:perl-PerlMagick-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/04/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/25");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + sp);
if (os_ver == "SLED15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-extra-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-extra-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"perl-PerlMagick-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"perl-PerlMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-config-7-SUSE-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-config-7-upstream-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"ImageMagick-devel-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagick++-7_Q16HDRI4-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagick++-devel-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagickCore-7_Q16HDRI6-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagickWand-7_Q16HDRI6-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-extra-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-extra-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"perl-PerlMagick-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"perl-PerlMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-config-7-SUSE-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-config-7-upstream-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-debugsource-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"ImageMagick-devel-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagick++-7_Q16HDRI4-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagick++-devel-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagickCore-7_Q16HDRI6-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagickWand-7_Q16HDRI6-7.0.7.34-3.54.3")) flag++;
if (rpm_check(release:"SLED15", sp:"0", reference:"libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-3.54.3")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1297.NASL
    descriptionAccording to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.(CVE-2019-7398) - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.(CVE-2019-10650) - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.(CVE-2019-9956) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-04-30
    plugin id124393
    published2019-04-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124393
    titleEulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2019-1297)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1296.NASL
    descriptionAccording to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.(CVE-2019-10650) - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.(CVE-2019-9956) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-04-30
    plugin id124392
    published2019-04-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124392
    titleEulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-1296)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200407_IMAGEMAGICK_ON_SL7_X.NASL
    description* ImageMagick: multiple security vulnerabilities
    last seen2020-04-30
    modified2020-04-21
    plugin id135797
    published2020-04-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135797
    titleScientific Linux Security Update : ImageMagick on SL7.x x86_64 (20200407)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1785.NASL
    descriptionNumerous security vulnerabilities were fixed in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id125093
    published2019-05-15
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125093
    titleDebian DLA-1785-1 : imagemagick security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4436.NASL
    descriptionThis update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed.
    last seen2020-06-01
    modified2020-06-02
    plugin id124345
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124345
    titleDebian DSA-4436-1 : imagemagick - security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-1180.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory. - ImageMagick: CPU exhaustion vulnerability in function ReadDDSInfo in coders/dds.c (CVE-2017-1000476) - ImageMagick: memory leak vulnerability in ReadXWDImage function in coders/xwd.c (CVE-2017-11166) - ImageMagick: memory exhaustion in function ReadTIFFImage causing denial of service (CVE-2017-12805) - ImageMagick: memory exhaustion in function format8BIM causing denial of service (CVE-2017-12806) - ImageMagick: memory leak in ReadPCDImage function in coders/pcd.c (CVE-2017-18251) - ImageMagick: assertion failure in MogrifyImageList function in MagickWand/mogrify.c (CVE-2017-18252) - ImageMagick: memory leak in WriteGIFImage function in coders/gif.c (CVE-2017-18254) - ImageMagick: infinite loop in ReadMIFFImage function in coders/miff.c (CVE-2017-18271) - ImageMagick: infinite loop ReadTXTImage in function in coders/txt.c (CVE-2017-18273) - ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file (CVE-2018-10177) - ImageMagick: Memory leak in WriteTIFFImage (CVE-2018-10804) - ImageMagick: Memory leak in ReadYCBCRImage (CVE-2018-10805) - ImageMagick: memory leak in ReadDCMImage function in coders/dcm.c (CVE-2018-11656) - ImageMagick: out of bounds write in ReadBMPImage and WriteBMPImage in coders/bmp.c (CVE-2018-12599) - ImageMagick: out of bounds write ReadDIBImage and WriteDIBImage in coders/dib.c (CVE-2018-12600) - ImageMagick: memory leak in the XMagickCommand function in MagickCore/animate.c (CVE-2018-13153) - ImageMagick: memory leak for a colormap in WriteMPCImage in coders/mpc.c (CVE-2018-14434) - ImageMagick: memory leak in DecodeImage in coders/pcd.c (CVE-2018-14435) - ImageMagick: memory leak in ReadMIFFImage in coders/miff.c (CVE-2018-14436) - ImageMagick: memory leak in parse8BIM in coders/meta.c (CVE-2018-14437) - ImageMagick: CPU Exhaustion via crafted input file (CVE-2018-15607) - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328) - ImageMagick: reachable assertion in ReadOneJNGImage in coders/png.c (CVE-2018-16749) - ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c (CVE-2018-16750) - ImageMagick: memory leak in WriteMSLImage of coders/msl.c (CVE-2018-18544) - ImageMagick: infinite loop in coders/bmp.c (CVE-2018-20467) - ImageMagick: double free in WriteEPTImage function in coders/ept.c (CVE-2018-8804) - ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c (CVE-2018-9133) - ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c (CVE-2019-10131) - ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file (CVE-2019-10650) - ImageMagick: denial of service in cineon parsing component (CVE-2019-11470) - ImageMagick: denial of service in ReadXWDImage in coders/xwd.c in the XWD image parsing component (CVE-2019-11472) - ImageMagick: heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c leading to DoS or information disclosure (CVE-2019-11597) - ImageMagick: heap-based buffer over-read in the function WritePNMImage of coders/pnm.c leading to DoS or information disclosure (CVE-2019-11598) - imagemagick: null-pointer dereference in function ReadPANGOImage in coders/pango.c and ReadVIDImage in coders/vid.c causing denial of service (CVE-2019-12974) - imagemagick: memory leak vulnerability in function WriteDPXImage in coders/dpx.c (CVE-2019-12975) - imagemagick: memory leak vulnerability in function ReadPCLImage in coders/pcl.c (CVE-2019-12976) - imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c (CVE-2019-12978) - imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c (CVE-2019-12979) - ImageMagick: a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c (CVE-2019-13133) - ImageMagick: a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c (CVE-2019-13134) - ImageMagick: a use of uninitialized value vulnerability in the function ReadCUTImage leading to a crash and DoS (CVE-2019-13135) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled (CVE-2019-13295) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled (CVE-2019-13297) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns (CVE-2019-13300) - ImageMagick: memory leaks in AcquireMagickMemory (CVE-2019-13301) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment (CVE-2019-13304) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error (CVE-2019-13305) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors (CVE-2019-13306) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows (CVE-2019-13307) - ImageMagick: memory leaks at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (CVE-2019-13309) - ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c (CVE-2019-13310) - ImageMagick: memory leaks at AcquireMagickMemory because of a wand/mogrify.c error (CVE-2019-13311) - ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c (CVE-2019-13454) - ImageMagick: use-after-free in magick/blob.c resulting in a denial of service (CVE-2019-14980) - ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c (CVE-2019-14981) - ImageMagick: out-of-bounds read in ReadXWDImage in coders/xwd.c (CVE-2019-15139) - ImageMagick: Use after free in ReadMATImage in coders/mat.c (CVE-2019-15140) - ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c (CVE-2019-15141) - ImageMagick: memory leak in magick/xwindow.c (CVE-2019-16708) - ImageMagick: memory leak in coders/dps.c (CVE-2019-16709) - ImageMagick: memory leak in coders/dot.c (CVE-2019-16710, CVE-2019-16713) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps2.c (CVE-2019-16711) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps3.c (CVE-2019-16712) - ImageMagick: heap-based buffer overflow in ReadPSInfo in coders/ps.c (CVE-2019-17540) - ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c (CVE-2019-17541) - ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c (CVE-2019-19948) - ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c (CVE-2019-19949) - imagemagick: memory leak in function DecodeImage in coders/pcd.c (CVE-2019-7175) - ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c (CVE-2019-7397) - ImageMagick: Memory leak in the WriteDIBImage function in coders/dib.c (CVE-2019-7398) - imagemagick: stack-based buffer overflow in function PopHexPixel in coders/ps.c (CVE-2019-9956) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-04-10
    plugin id135354
    published2020-04-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135354
    titleCentOS 7 : ImageMagick / autotrace / emacs / inkscape (CESA-2020:1180)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1180.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory. - ImageMagick: CPU exhaustion vulnerability in function ReadDDSInfo in coders/dds.c (CVE-2017-1000476) - ImageMagick: memory leak vulnerability in ReadXWDImage function in coders/xwd.c (CVE-2017-11166) - ImageMagick: memory exhaustion in function ReadTIFFImage causing denial of service (CVE-2017-12805) - ImageMagick: memory exhaustion in function format8BIM causing denial of service (CVE-2017-12806) - ImageMagick: memory leak in ReadPCDImage function in coders/pcd.c (CVE-2017-18251) - ImageMagick: assertion failure in MogrifyImageList function in MagickWand/mogrify.c (CVE-2017-18252) - ImageMagick: memory leak in WriteGIFImage function in coders/gif.c (CVE-2017-18254) - ImageMagick: infinite loop in ReadMIFFImage function in coders/miff.c (CVE-2017-18271) - ImageMagick: infinite loop ReadTXTImage in function in coders/txt.c (CVE-2017-18273) - ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file (CVE-2018-10177) - ImageMagick: Memory leak in WriteTIFFImage (CVE-2018-10804) - ImageMagick: Memory leak in ReadYCBCRImage (CVE-2018-10805) - ImageMagick: memory leak in ReadDCMImage function in coders/dcm.c (CVE-2018-11656) - ImageMagick: out of bounds write in ReadBMPImage and WriteBMPImage in coders/bmp.c (CVE-2018-12599) - ImageMagick: out of bounds write ReadDIBImage and WriteDIBImage in coders/dib.c (CVE-2018-12600) - ImageMagick: memory leak in the XMagickCommand function in MagickCore/animate.c (CVE-2018-13153) - ImageMagick: memory leak for a colormap in WriteMPCImage in coders/mpc.c (CVE-2018-14434) - ImageMagick: memory leak in DecodeImage in coders/pcd.c (CVE-2018-14435) - ImageMagick: memory leak in ReadMIFFImage in coders/miff.c (CVE-2018-14436) - ImageMagick: memory leak in parse8BIM in coders/meta.c (CVE-2018-14437) - ImageMagick: CPU Exhaustion via crafted input file (CVE-2018-15607) - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328) - ImageMagick: reachable assertion in ReadOneJNGImage in coders/png.c (CVE-2018-16749) - ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c (CVE-2018-16750) - ImageMagick: memory leak in WriteMSLImage of coders/msl.c (CVE-2018-18544) - ImageMagick: infinite loop in coders/bmp.c (CVE-2018-20467) - ImageMagick: double free in WriteEPTImage function in coders/ept.c (CVE-2018-8804) - ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c (CVE-2018-9133) - ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c (CVE-2019-10131) - ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file (CVE-2019-10650) - ImageMagick: denial of service in cineon parsing component (CVE-2019-11470) - ImageMagick: denial of service in ReadXWDImage in coders/xwd.c in the XWD image parsing component (CVE-2019-11472) - ImageMagick: heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c leading to DoS or information disclosure (CVE-2019-11597) - ImageMagick: heap-based buffer over-read in the function WritePNMImage of coders/pnm.c leading to DoS or information disclosure (CVE-2019-11598) - imagemagick: null-pointer dereference in function ReadPANGOImage in coders/pango.c and ReadVIDImage in coders/vid.c causing denial of service (CVE-2019-12974) - imagemagick: memory leak vulnerability in function WriteDPXImage in coders/dpx.c (CVE-2019-12975) - imagemagick: memory leak vulnerability in function ReadPCLImage in coders/pcl.c (CVE-2019-12976) - imagemagick: use of uninitialized value in function ReadPANGOImage in coders/pango.c (CVE-2019-12978) - imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c (CVE-2019-12979) - ImageMagick: a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c (CVE-2019-13133) - ImageMagick: a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c (CVE-2019-13134) - ImageMagick: a use of uninitialized value vulnerability in the function ReadCUTImage leading to a crash and DoS (CVE-2019-13135) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled (CVE-2019-13295) - ImageMagick: heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled (CVE-2019-13297) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns (CVE-2019-13300) - ImageMagick: memory leaks in AcquireMagickMemory (CVE-2019-13301) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment (CVE-2019-13304) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error (CVE-2019-13305) - ImageMagick: stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors (CVE-2019-13306) - ImageMagick: heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows (CVE-2019-13307) - ImageMagick: memory leaks at AcquireMagickMemory due to mishandling the NoSuchImage error in CLIListOperatorImages (CVE-2019-13309) - ImageMagick: memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c (CVE-2019-13310) - ImageMagick: memory leaks at AcquireMagickMemory because of a wand/mogrify.c error (CVE-2019-13311) - ImageMagick: division by zero in RemoveDuplicateLayers in MagickCore/layer.c (CVE-2019-13454) - ImageMagick: use-after-free in magick/blob.c resulting in a denial of service (CVE-2019-14980) - ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c (CVE-2019-14981) - ImageMagick: out-of-bounds read in ReadXWDImage in coders/xwd.c (CVE-2019-15139) - ImageMagick: Use after free in ReadMATImage in coders/mat.c (CVE-2019-15140) - ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c (CVE-2019-15141) - ImageMagick: memory leak in magick/xwindow.c (CVE-2019-16708) - ImageMagick: memory leak in coders/dps.c (CVE-2019-16709) - ImageMagick: memory leak in coders/dot.c (CVE-2019-16710, CVE-2019-16713) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps2.c (CVE-2019-16711) - ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps3.c (CVE-2019-16712) - ImageMagick: heap-based buffer overflow in ReadPSInfo in coders/ps.c (CVE-2019-17540) - ImageMagick: Use after free in ReadICCProfile function in coders/jpeg.c (CVE-2019-17541) - ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c (CVE-2019-19948) - ImageMagick: heap-based buffer over-read in WritePNGImage in coders/png.c (CVE-2019-19949) - imagemagick: memory leak in function DecodeImage in coders/pcd.c (CVE-2019-7175) - ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c (CVE-2019-7397) - ImageMagick: Memory leak in the WriteDIBImage function in coders/dib.c (CVE-2019-7398) - imagemagick: stack-based buffer overflow in function PopHexPixel in coders/ps.c (CVE-2019-9956) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-03-31
    plugin id135041
    published2020-03-31
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135041
    titleRHEL 7 : ImageMagick (RHSA-2020:1180)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1298.NASL
    descriptionAccording to the version of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.(CVE-2019-9956) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-04-30
    plugin id124394
    published2019-04-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124394
    titleEulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2019-1298)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1320.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381). - CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). - CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). - CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368). - CVE-2018-16413: Fixed a heap-based buffer over-read in PushShortPixel() (bsc#1106989). - CVE-2018-16412: Fixed a heap-based buffer over-read in ParseImageResourceBlocks() (bsc#1106996). - CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). - CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053). - Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected : - ImageMagick-config-6-SUSE: This has the PS decoders disabled. - ImageMagick-config-6-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id124639
    published2019-05-06
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124639
    titleopenSUSE Security Update : ImageMagick (openSUSE-2019-1320)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1331.NASL
    descriptionThis update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054). - Added extra -config- packages with Postscript/EPS/PDF readers still enabled. Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033) These are two packages that can be selected : - ImageMagick-config-7-SUSE: This has the PS decoders disabled. - ImageMagick-config-7-upstream: This has the PS decoders enabled. Depending on your local needs install either one of them. The default is the -SUSE configuration. This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id124643
    published2019-05-06
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124643
    titleopenSUSE Security Update : ImageMagick (openSUSE-2019-1331)
  • NASL familyWindows
    NASL idIMAGEMAGICK_7_0_8-44.NASL
    descriptionThe version of ImageMagick installed on the remote Windows host is 7.x prior to 7.0.8-44. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists due to a failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this by convincing a user into converting a specially crafted file, to cause the system to stop responding. (CVE-2018-15607) - A stack-based buffer overflow condition exists in the PopHexPixel function due to a failure to handle exceptional conditions. An unauthenticated,remote attacker can exploit this, via convincing a user to open a crafted image file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-9956) - A memory leak vulnerability exists in the SVGKeyValuePairs function due to a failure to handle exceptional conditions. An unauthenticated, remote attacker can exploit this via convincing a user to open a crafted image file, to cause the application to stop responding. (CVE-2019-10649) Note that the application may also be affected by additional vulnerabilities. Refer to the vendor for additional information.
    last seen2020-06-01
    modified2020-06-02
    plugin id124776
    published2019-05-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124776
    titleImageMagick < 7.0.8-44 Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4034-1.NASL
    descriptionIt was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick safely, the update for Ubuntu 18.10 and Ubuntu 19.04 includes a default policy change that disables support for the Postscript and PDF formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick policy configuration. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126254
    published2019-06-26
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126254
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : imagemagick vulnerabilities (USN-4034-1)

Redhat

advisories
bugzilla
id1801681
titleCVE-2019-16713 ImageMagick: memory leak in coders/dot.c
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentinkscape is earlier than 0:0.92.2-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180001
        • commentinkscape is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20152197358
      • AND
        • commentinkscape-view is earlier than 0:0.92.2-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180003
        • commentinkscape-view is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20152197362
      • AND
        • commentinkscape-docs is earlier than 0:0.92.2-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180005
        • commentinkscape-docs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20152197360
      • AND
        • commentautotrace-devel is earlier than 0:0.31.1-38.el7
          ovaloval:com.redhat.rhsa:tst:20201180007
        • commentautotrace-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20201180008
      • AND
        • commentautotrace is earlier than 0:0.31.1-38.el7
          ovaloval:com.redhat.rhsa:tst:20201180009
        • commentautotrace is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20201180010
      • AND
        • commentemacs-filesystem is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180011
        • commentemacs-filesystem is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771012
      • AND
        • commentemacs-nox is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180013
        • commentemacs-nox is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771010
      • AND
        • commentemacs-common is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180015
        • commentemacs-common is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771008
      • AND
        • commentemacs is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180017
        • commentemacs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771006
      • AND
        • commentemacs-terminal is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180019
        • commentemacs-terminal is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771004
      • AND
        • commentemacs-el is earlier than 1:24.3-23.el7
          ovaloval:com.redhat.rhsa:tst:20201180021
        • commentemacs-el is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20172771002
      • AND
        • commentImageMagick-perl is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180023
        • commentImageMagick-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544006
      • AND
        • commentImageMagick-c++ is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180025
        • commentImageMagick-c++ is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544010
      • AND
        • commentImageMagick is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180027
        • commentImageMagick is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544008
      • AND
        • commentImageMagick-doc is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180029
        • commentImageMagick-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544012
      • AND
        • commentImageMagick-devel is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180031
        • commentImageMagick-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544004
      • AND
        • commentImageMagick-c++-devel is earlier than 0:6.9.10.68-3.el7
          ovaloval:com.redhat.rhsa:tst:20201180033
        • commentImageMagick-c++-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20120544002
rhsa
idRHSA-2020:1180
released2020-03-31
severityModerate
titleRHSA-2020:1180: ImageMagick security, bug fix, and enhancement update (Moderate)
rpms
  • ImageMagick-0:6.9.10.68-3.el7
  • ImageMagick-c++-0:6.9.10.68-3.el7
  • ImageMagick-c++-devel-0:6.9.10.68-3.el7
  • ImageMagick-debuginfo-0:6.9.10.68-3.el7
  • ImageMagick-devel-0:6.9.10.68-3.el7
  • ImageMagick-doc-0:6.9.10.68-3.el7
  • ImageMagick-perl-0:6.9.10.68-3.el7
  • autotrace-0:0.31.1-38.el7
  • autotrace-debuginfo-0:0.31.1-38.el7
  • autotrace-devel-0:0.31.1-38.el7
  • emacs-1:24.3-23.el7
  • emacs-common-1:24.3-23.el7
  • emacs-debuginfo-1:24.3-23.el7
  • emacs-el-1:24.3-23.el7
  • emacs-filesystem-1:24.3-23.el7
  • emacs-nox-1:24.3-23.el7
  • emacs-terminal-1:24.3-23.el7
  • inkscape-0:0.92.2-3.el7
  • inkscape-debuginfo-0:0.92.2-3.el7
  • inkscape-docs-0:0.92.2-3.el7
  • inkscape-view-0:0.92.2-3.el7

References