{"affected":[{"ecosystem_specific":{"binaries":[{"ImageMagick":"6.8.8.1-71.54.5","libMagick++-6_Q16-3":"6.8.8.1-71.54.5","libMagickCore-6_Q16-1":"6.8.8.1-71.54.5","libMagickCore-6_Q16-1-32bit":"6.8.8.1-71.54.5","libMagickWand-6_Q16-1":"6.8.8.1-71.54.5"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","name":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"ImageMagick":"6.8.8.1-71.54.5","ImageMagick-devel":"6.8.8.1-71.54.5","libMagick++-6_Q16-3":"6.8.8.1-71.54.5","libMagick++-devel":"6.8.8.1-71.54.5","perl-PerlMagick":"6.8.8.1-71.54.5"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libMagickCore-6_Q16-1":"6.8.8.1-71.54.5","libMagickWand-6_Q16-1":"6.8.8.1-71.54.5"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","name":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libMagickCore-6_Q16-1":"6.8.8.1-71.54.5","libMagickWand-6_Q16-1":"6.8.8.1-71.54.5"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","name":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"ImageMagick":"6.8.8.1-71.54.5","libMagick++-6_Q16-3":"6.8.8.1-71.54.5","libMagickCore-6_Q16-1-32bit":"6.8.8.1-71.54.5"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","name":"ImageMagick","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for ImageMagick fixes the following issues:\n\n- CVE-2017-14325: In ImageMagick, a memory leak vulnerability was found in\n  the function PersistPixelCache in magick/cache.c, which allowed attackers\n  to cause a denial of service (memory consumption in ReadMPCImage in\n  coders/mpc.c) via a crafted file.  [bsc#1058635]\n- CVE-2017-17887: In ImageMagick, a memory leak vulnerability was found\n  in the function GetImagePixelCache in magick/cache.c, which allowed\n  attackers to cause a denial of service via a crafted MNG image file that\n  is processed by ReadOneMNGImage.  [bsc#1074117]\n- CVE-2017-18250: A NULL pointer dereference vulnerability was found in the function \n  LogOpenCLBuildFailure in MagickCore/opencl.c, which could lead to a denial of service \n  via a crafted file. [bsc#1087039]\n- CVE-2017-18251: A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, \n  which could lead to a denial of service via a crafted file. [bsc#1087037]\n- CVE-2017-18252: The MogrifyImageList function in MagickWand/mogrify.c could allow \n  attackers to cause a denial of service via a crafted file. [bsc#1087033]\n- CVE-2017-18254: A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, \n  which could lead to  denial of service via a crafted file. [bsc#1087027]\n- CVE-2018-8960: The ReadTIFFImage function in coders/tiff.c in\n  ImageMagick did not properly restrict memory allocation, leading to a\n  heap-based buffer over-read.  [bsc#1086782]\n- CVE-2018-9018: divide-by-zero in the ReadMNGImage function of coders/png.c. \n  Attackers could leverage this vulnerability to cause a crash and denial of service \n  via a crafted mng file. [bsc#1086773]\n- CVE-2018-9135: heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c \n  could lead to denial of service. [bsc#1087825]\n- CVE-2018-10177: In ImageMagick, there was an infinite loop in the\n  ReadOneMNGImage function of the coders/png.c file. Remote attackers\n  could leverage this vulnerability to cause a denial of service via a\n  crafted mng file.  [bsc#1089781]\n- CVE-2017-10928: a heap-based buffer over-read in the GetNextToken function in token.c \n  could allow attackers to obtain sensitive information from process memory or possibly have \n  unspecified other impact via a crafted SVG document that is mishandled in the \n  GetUserSpaceCoordinateValue function in coders/svg.c. [bsc#1047356]\n\n","id":"SUSE-SU-2018:1178-1","modified":"2018-05-09T11:30:27Z","published":"2018-05-09T11:30:27Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181178-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1047356"},{"type":"REPORT","url":"https://bugzilla.suse.com/1058635"},{"type":"REPORT","url":"https://bugzilla.suse.com/1074117"},{"type":"REPORT","url":"https://bugzilla.suse.com/1086773"},{"type":"REPORT","url":"https://bugzilla.suse.com/1086782"},{"type":"REPORT","url":"https://bugzilla.suse.com/1087027"},{"type":"REPORT","url":"https://bugzilla.suse.com/1087033"},{"type":"REPORT","url":"https://bugzilla.suse.com/1087037"},{"type":"REPORT","url":"https://bugzilla.suse.com/1087039"},{"type":"REPORT","url":"https://bugzilla.suse.com/1087825"},{"type":"REPORT","url":"https://bugzilla.suse.com/1089781"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-1000476"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-10928"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-11450"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14325"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-17887"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-18250"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-18251"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-18252"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-18254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-10177"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-8960"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-9018"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-9135"}],"related":["CVE-2017-1000476","CVE-2017-10928","CVE-2017-11450","CVE-2017-14325","CVE-2017-17887","CVE-2017-18250","CVE-2017-18251","CVE-2017-18252","CVE-2017-18254","CVE-2018-10177","CVE-2018-8960","CVE-2018-9018","CVE-2018-9135"],"summary":"Security update for ImageMagick","upstream":["CVE-2017-1000476","CVE-2017-10928","CVE-2017-11450","CVE-2017-14325","CVE-2017-17887","CVE-2017-18250","CVE-2017-18251","CVE-2017-18252","CVE-2017-18254","CVE-2018-10177","CVE-2018-8960","CVE-2018-9018","CVE-2018-9135"]}