Security update for ImageMagick

This update for ImageMagick fixes the following issues:

- CVE-2017-9405: A memory leak in the ReadICONImage function was fixed that could lead to DoS via memory exhaustion (bsc#1042911)
- CVE-2017-9407: In ImageMagick, the ReadPALMImage function in palm.c allowed attackers to cause a denial of service (memory leak) via a crafted file. (bsc#1042824)
- CVE-2017-11166: In ReadXWDImage in coders\xwd.c a memoryleak could have caused memory exhaustion via a crafted length (bsc#1048110)
- CVE-2017-11170: ReadTGAImage in coders\tga.c allowed for memory exhaustion via invalid colors data in the header of a TGA or VST file (bsc#1048272)
- CVE-2017-11448: The ReadJPEGImage function in coders/jpeg.c in ImageMagick allowed remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. (bsc#1049375)
- CVE-2017-11450: A remote denial of service in coders/jpeg.c was fixed (bsc#1049374)
- CVE-2017-11528: ReadDIBImage in coders/dib.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050119)
- CVE-2017-11530: ReadEPTImage in coders/ept.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050122)
- CVE-2017-11531: When ImageMagick processed a crafted file in convert, it could lead to a Memory Leak in the WriteHISTOGRAMImage() function in coders/histogram.c. (bsc#1050126)
- CVE-2017-11533: A information leak by 1 byte due to heap-based buffer over-read in the WriteUILImage() in coders/uil.c was fixed (bsc#1050132)
- CVE-2017-11537: When ImageMagick processed a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation. (bsc#1050048)
- CVE-2017-11638, CVE-2017-11642: A NULL pointer dereference in theWriteMAPImage() in coders/map.c was fixed which could lead to a crash (bsc#1050617)
- CVE-2017-12418: ImageMagick had memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c. (bsc#1052207)
- CVE-2017-12427: ProcessMSLScript coders/msl.c allowed remote attackers to cause a DoS (bsc#1052248)
- CVE-2017-12429: A memory exhaustion flaw in ReadMIFFImage in coders/miff.c was fixed, which allowed attackers to cause DoS (bsc#1052251)
- CVE-2017-12432: In ImageMagick, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allowed attackers to cause a denial of service. (bsc#1052254)
- CVE-2017-12566: A memory leak in ReadMVGImage in coders/mvg.c, could have allowed attackers to cause DoS (bsc#1052472)
- CVE-2017-12654: The ReadPICTImage function in coders/pict.c in ImageMagick allowed attackers to cause a denial of service (memory leak) via a crafted file. (bsc#1052761)
- CVE-2017-12663: A memory leak in WriteMAPImage in coders/map.c was fixed that could lead to a DoS via memory exhaustion (bsc#1052754)
- CVE-2017-12664: ImageMagick had a memory leak vulnerability in WritePALMImage in coders/palm.c. (bsc#1052750)
- CVE-2017-12665: ImageMagick had a memory leak vulnerability in WritePICTImage in coders/pict.c. (bsc#1052747)
- CVE-2017-12668: ImageMagick had a memory leak vulnerability in WritePCXImage in coders/pcx.c. (bsc#1052688)
- CVE-2017-12674: A CPU exhaustion in ReadPDBImage in coders/pdb.c was fixed, which allowed attackers to cause DoS (bsc#1052711)
- CVE-2017-13058: In ImageMagick, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allowed attackers to cause a denial of service via a crafted file. (bsc#1055069)
- CVE-2017-13131: A memory leak vulnerability was found in thefunction ReadMIFFImage in coders/miff.c, which allowed attackers tocause a denial of service (memory consumption in NewL (bsc#1055229)
- CVE-2017-14060: A NULL Pointer Dereference issue in the ReadCUTImage function in coders/cut.c was fixed that could have caused a Denial of Service (bsc#1056768)
- CVE-2017-14139: A memory leak vulnerability in WriteMSLImage in coders/msl.c was fixed. (bsc#1057163)
- CVE-2017-14224: A heap-based buffer overflow in WritePCXImage in coders/pcx.c could lead to denial of service or code execution. (bsc#1058009)
- CVE-2017-17682: A large loop vulnerability was fixed in ExtractPostscript in coders/wpg.c, which allowed attackers to cause a denial of service (CPU exhaustion) (bsc#1072898)
- CVE-2017-17885: In ImageMagick, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allowed attackers to cause a denial of service via a crafted PICT image file. (bsc#1074119)
- CVE-2017-17934: A memory leak in the function MSLPopImage and ProcessMSLScript could have lead to a denial of service (bsc#1074170)
- CVE-2017-18028: A memory exhaustion in the function ReadTIFFImage in coders/tiff.c was fixed. (bsc#1076182)
- CVE-2018-5357: ImageMagick had memory leaks in the ReadDCMImage function in coders/dcm.c. (bsc#1075821)
- CVE-2018-6405: In the ReadDCMImage function in coders/dcm.c in ImageMagick, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allowed remote attackers to cause a denial of service. (bsc#1078433)

This update was imported from the SUSE:SLE-12:Update update project.

Fixed bugs
bnc#1052207
VUL-2: CVE-2017-12418: GraphicsMagick, ImageMagick: memory leaks in the parse8BIMW and format8BIM functions
bnc#1052747
VUL-2: CVE-2017-12665: GraphicsMagick, ImageMagick: Memory leak vulnerability in WritePICTImage in coders/pict.c
bnc#1052688
VUL-2: CVE-2017-12668: GraphicsMagick, ImageMagick: Memory leak in WritePCXImage incoders/pcx.c
bnc#1049375
VUL-0: CVE-2017-11448: ImageMagick, GraphicsMagick: ReadJPEGImage in coders/jpeg.c allows remote attackers to obtain sensitive information from uninitialized memory
bnc#1049374
VUL-1: CVE-2017-11450: ImageMagick: coders/jpeg.c in ImageMagick before 7.0.6-1 remote denial of service
bnc#1052254
VUL-1: CVE-2017-12432: GraphicsMagick, ImageMagick: Memory exhaustion vulnerability in ReadPCXImage in coders/pcx.c, which allows attackers to cause DoS
bnc#1076182
VUL-1: CVE-2017-18028: GraphicsMagick,ImageMagick: memory exhaustion in the function ReadTIFFImage in coders/tiff.c
bnc#1075821
VUL-1: CVE-2018-5357: ImageMagick: memory leak in the ReadDCMImage function incoders/dcm.c could lead to denial of service
bnc#1055069
VUL-2: CVE-2017-13058: ImageMagick: In ImageMagick 7.0.6-6, a memory leak vulnerability was found in thefunction WritePCXImage in coders/pcx.c, which allows attackers to causea denial of service via a crafted file.
bnc#1042824
VUL-2: CVE-2017-9407: ImageMagick: Memory leak in the ReadPALMImage function
bnc#1052750
VUL-1: CVE-2017-12664: GraphicsMagick, ImageMagick: Memory leak in WritePALMImage in coders/palm.c
bnc#1058009
VUL-0: CVE-2017-14224: ImageMagick: A heap-based buffer overflow in WritePCXImage in coders/pcx.c could lead to denial of service or code execution
bnc#1078433
VUL-1: CVE-2018-6405: GraphicsMagick,ImageMagick: In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23,each redmap, greenmap, and bluemap variable can be overwritten by a new pointer.The previous pointer is lost, wh
bnc#1052761
VUL-1: CVE-2017-12654: GraphicsMagick, ImageMagick: Memory leak in ReadPICTImage in coders/pict.c allows for DoS
bnc#1074119
VUL-0: CVE-2017-17885: ImageMagick: A Memory leak in the function ReadPICTImage could lead to a denial of service
bnc#1050048
VUL-2: CVE-2017-11537: ImageMagick: Floating Point Exception in WritePALMImage() in coders/palm.c
bnc#1050126
VUL-2: CVE-2017-11531: ImageMagick: Memory Leak in the WriteHISTOGRAMImage() in coders/histogram.c
bnc#1048110
VUL-1: CVE-2017-11166: ImageMagick: In ReadXWDImage in coders\xwd.c a memoryleak can cause memory exhaustion via a crafted length
bnc#1048272
VUL-1: CVE-2017-11170: GraphicsMagick, ImageMagick: ReadTGAImage in coders\tga.c allows for memory exhaustion via invalid colors data in the header of a TGA or VST file
bnc#1050617
VUL-2: CVE-2017-11638, CVE-2017-11642: GraphicsMagick, ImageMagick: NULL pointer dereference in theWriteMAPImage() in coders/map.c
bnc#1052248
VUL-1: CVE-2017-12427: GraphicsMagick, ImageMagick: ProcessMSLScript coders/msl.c allows remote attackers to cause a DoS
bnc#1052251
VUL-1: CVE-2017-12429: GraphicsMagick, ImageMagick: Memory exhaustion in ReadMIFFImage in coders/miff.c, which allows attackers to cause DoS
bnc#1052472
VUL-2: CVE-2017-12566: GraphicsMagick, ImageMagick: Memory leak in ReadMVGImage in coders/mvg.c, which allows attackers to cause DoS
bnc#1052711
VUL-1: CVE-2017-12674: ImageMagick: CPU exhaustion in ReadPDBImage in coders/pdb.c, which allows attackers to cause DoS
bnc#1055229
VUL-2: CVE-2017-13131: ImageMagick: In ImageMagick 7.0.6-8, a memory leak vulnerability was found in thefunction ReadMIFFImage in coders/miff.c, which allows attackers tocause a denial of service (memory consumption in NewL
bnc#1056768
VUL-2: CVE-2017-14060: GraphicsMagick,ImageMagick: NULL Pointer Dereference issue in the ReadCUTImage function in coders/cut.c that could cause a Denial of Service
bnc#1057163
VUL-1: CVE-2017-14139: GraphicsMagick,ImageMagick: memory leak vulnerability in WriteMSLImage in coders/msl.c.
bnc#1074170
VUL-0: CVE-2017-17934: ImageMagick: A Memory leak in the function MSLPopImage and ProcessMSLScript could lead to a denial of service
bnc#1050119
VUL-2: CVE-2017-11528: GraphicsMagick, ImageMagick: ReadDIBImage in coders/dib.c allows remote attackers to cause DoS
bnc#1042911
VUL-1: CVE-2017-9405: ImageMagick: Memory leak in the ReadICONImage function
bnc#1072898
VUL-1: CVE-2017-17682: GraphicsMagick,ImageMagick: In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in thefunction ExtractPostscript in coders/wpg.c, which allows attackers to cause adenial of service (CPU exhaustion) via
bnc#1050132
VUL-2: CVE-2017-11533: GraphicsMagick, ImageMagick: infoleak by 1 byte due to heap-based buffer over-read in the WriteUILImage() in coders/uil.c
bnc#1050122
VUL-1: CVE-2017-11530: GraphicsMagick, ImageMagick: ReadEPTImage in coders/ept.c allows remote attackers to cause DoS
bnc#1052754
VUL-1: CVE-2017-12663: GraphicsMagick, ImageMagick: Memory leak in WriteMAPImage in coders/map.c
Selected Binaries
openSUSE Build Service is sponsored by