Executive Summary

Summary
Titlegraphicsmagick security update
Informations
NameDSA-3746First vendor Publication2016-12-24
VendorDebianLast vendor Modification2016-12-24
Severity (Vendor) N/ARevision1

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilities have been discovered in GraphicsMagick, a collection of image processing tool, which can cause denial of service attacks, remote file deletion, and remote command execution.

This security update removes the full support of PLT/Gnuplot decoder to prevent Gnuplot-shell based shell exploits for fixing the CVE-2016-3714 vulnerability.

The undocumented "TMP" magick prefix no longer removes the argument file after it has been read for fixing the CVE-2016-3715 vulnerability. Since the "TMP" feature was originally implemented, GraphicsMagick added a temporary file management subsystem which assures that temporary files are removed so this feature is not needed.

Remove support for reading input from a shell command, or writing output to a shell command, by prefixing the specified filename (containing the command) with a '|' for fixing the CVE-2016-5118 vulnerability.

CVE-2015-8808

Gustavo Grieco discovered an out of bound read in the parsing of GIF files which may cause denial of service.

CVE-2016-2317

Gustavo Grieco discovered a stack buffer overflow and two heap buffer overflows while processing SVG images which may cause denial of service.

CVE-2016-2318

Gustavo Grieco discovered several segmentation faults while processing SVG images which may cause denial of service.

CVE-2016-5240

Gustavo Grieco discovered an endless loop problem caused by negative stroke-dasharray arguments while parsing SVG files which may cause denial of service.

CVE-2016-7800

Marco Grassi discovered an unsigned underflow leading to heap overflow when parsing 8BIM chunk often attached to JPG files which may cause denial of service.

CVE-2016-7996

Moshe Kaplan discovered that there is no check that the provided colormap is not larger than 256 entries in the WPG reader which may cause denial of service.

CVE-2016-7997

Moshe Kaplan discovered that an assertion is thrown for some files in the WPG reader due to a logic error which may cause denial of service.

CVE-2016-8682

Agostino Sarubbo of Gentoo discovered a stack buffer read overflow while reading the SCT header which may cause denial of service.

CVE-2016-8683

Agostino Sarubbo of Gentoo discovered a memory allocation failure in the PCX coder which may cause denial of service.

CVE-2016-8684

Agostino Sarubbo of Gentoo discovered a memory allocation failure in the SGI coder which may cause denial of service.

CVE-2016-9830

Agostino Sarubbo of Gentoo discovered a memory allocation failure in MagickRealloc() function which may cause denial of service.

For the stable distribution (jessie), these problems have been fixed in version 1.3.20-3+deb8u2.

For the testing distribution (stretch), these problems (with the exception of CVE-2016-9830) have been fixed in version 1.3.25-5.

For the unstable distribution (sid), these problems have been fixed in version 1.3.25-6.

We recommend that you upgrade your graphicsmagick packages.

Original Source

Url : http://www.debian.org/security/2016/dsa-3746

CWE : Common Weakness Enumeration

%idName
40 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer
20 %CWE-20Improper Input Validation
13 %CWE-476NULL Pointer Dereference
13 %CWE-284Access Control (Authorization) Issues
7 %CWE-191Integer Underflow (Wrap or Wraparound)
7 %CWE-125Out-of-bounds Read

CPE : Common Platform Enumeration

TypeDescriptionCount
Application59
Application832
Application1
Application1
Os4
Os2
Os1
Os2
Os2
Os2
Os2
Os2
Os1
Os2
Os2
Os2
Os2
Os1
Os2
Os1
Os1
Os1
Os2
Os1
Os1

Snort® IPS/IDS

DateDescription
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41902 - Revision : 2 - Type : POLICY-OTHER
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41901 - Revision : 2 - Type : POLICY-OTHER
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41900 - Revision : 2 - Type : POLICY-OTHER
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41899 - Revision : 2 - Type : POLICY-OTHER
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41898 - Revision : 2 - Type : POLICY-OTHER
2017-04-12ImageMagick magick vector graphics ephemeral access attempt
RuleID : 41897 - Revision : 2 - Type : POLICY-OTHER
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39097 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39096 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39095 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39094 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39093 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39092 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39091 - Revision : 2 - Type : FILE-IMAGE
2016-07-01ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39090 - Revision : 2 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39006 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39005 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39004 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39003 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39002 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39001 - Revision : 3 - Type : FILE-IMAGE
2016-06-22ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 39000 - Revision : 3 - Type : FILE-IMAGE
2016-06-17ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38948 - Revision : 4 - Type : FILE-IMAGE
2016-06-17ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38947 - Revision : 4 - Type : FILE-IMAGE
2016-06-17ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38946 - Revision : 4 - Type : FILE-IMAGE
2016-06-17ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38945 - Revision : 4 - Type : FILE-IMAGE
2016-06-14ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38871 - Revision : 5 - Type : FILE-IMAGE
2016-06-07ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38744 - Revision : 7 - Type : FILE-IMAGE
2016-06-07ImageMagick WWWDecodeDelegate command injection attempt
RuleID : 38743 - Revision : 6 - Type : FILE-IMAGE

Nessus® Vulnerability Scanner

DateDescription
2018-08-13Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_e714b7d239f649929f48e6b2f5f949df.nasl - Type : ACT_GATHER_INFO
2018-06-21Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_25f73c4768a84a309cbc1ca5eea4d6ba.nasl - Type : ACT_GATHER_INFO
2017-05-01Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2016-1021.nasl - Type : ACT_GATHER_INFO
2017-05-01Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2016-1029.nasl - Type : ACT_GATHER_INFO
2017-04-21Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2017-820.nasl - Type : ACT_GATHER_INFO
2017-03-13Name : The remote Fedora host is missing a security update.
File : fedora_2017-d2bab54ac9.nasl - Type : ACT_GATHER_INFO
2017-03-10Name : The remote Fedora host is missing a security update.
File : fedora_2017-c71a0f40f0.nasl - Type : ACT_GATHER_INFO
2016-12-27Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3746.nasl - Type : ACT_GATHER_INFO
2016-12-27Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1511.nasl - Type : ACT_GATHER_INFO
2016-12-12Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1430.nasl - Type : ACT_GATHER_INFO
2016-12-01Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2964-1.nasl - Type : ACT_GATHER_INFO
2016-11-14Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1282.nasl - Type : ACT_GATHER_INFO
2016-10-31Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1242.nasl - Type : ACT_GATHER_INFO
2016-10-31Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-2667-1.nasl - Type : ACT_GATHER_INFO
2016-10-27Name : The remote Debian host is missing a security update.
File : debian_DLA-683.nasl - Type : ACT_GATHER_INFO
2016-10-27Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1229.nasl - Type : ACT_GATHER_INFO
2016-10-27Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1230.nasl - Type : ACT_GATHER_INFO
2016-10-12Name : The remote Debian host is missing a security update.
File : debian_DLA-651.nasl - Type : ACT_GATHER_INFO
2016-08-29Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1610-1.nasl - Type : ACT_GATHER_INFO
2016-08-16Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-984.nasl - Type : ACT_GATHER_INFO
2016-08-02Name : The remote Debian host is missing a security update.
File : debian_DLA-547.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-0d90ead5d7.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-40ccaff4d1.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-7a878ed298.nasl - Type : ACT_GATHER_INFO
2016-07-12Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL82747025.nasl - Type : ACT_GATHER_INFO
2016-07-05Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-825.nasl - Type : ACT_GATHER_INFO
2016-06-23Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-716.nasl - Type : ACT_GATHER_INFO
2016-06-23Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-717.nasl - Type : ACT_GATHER_INFO
2016-06-23Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-757.nasl - Type : ACT_GATHER_INFO
2016-06-20Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160617_ImageMagick_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-06-17Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-1237.nasl - Type : ACT_GATHER_INFO
2016-06-17Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-1237.nasl - Type : ACT_GATHER_INFO
2016-06-17Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-1237.nasl - Type : ACT_GATHER_INFO
2016-06-17Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1570-1.nasl - Type : ACT_GATHER_INFO
2016-06-10Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-700.nasl - Type : ACT_GATHER_INFO
2016-06-09Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-693.nasl - Type : ACT_GATHER_INFO
2016-06-09Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-694.nasl - Type : ACT_GATHER_INFO
2016-06-03Name : The remote Debian host is missing a security update.
File : debian_DLA-500.nasl - Type : ACT_GATHER_INFO
2016-06-03Name : The remote Debian host is missing a security update.
File : debian_DLA-502.nasl - Type : ACT_GATHER_INFO
2016-06-03Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2990-1.nasl - Type : ACT_GATHER_INFO
2016-06-02Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3591.nasl - Type : ACT_GATHER_INFO
2016-05-31Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2016-152-01.nasl - Type : ACT_GATHER_INFO
2016-05-24Name : The remote Debian host is missing a security update.
File : debian_DLA-484.nasl - Type : ACT_GATHER_INFO
2016-05-23Name : The remote Debian host is missing a security update.
File : debian_DLA-486.nasl - Type : ACT_GATHER_INFO
2016-05-17Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3580.nasl - Type : ACT_GATHER_INFO
2016-05-16Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL10550253.nasl - Type : ACT_GATHER_INFO
2016-05-12Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-699.nasl - Type : ACT_GATHER_INFO
2016-05-12Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL03151140.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0726.nasl - Type : ACT_GATHER_INFO
2016-05-09Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_0d724b05687f45279c03af34d3b094ec.nasl - Type : ACT_GATHER_INFO
2016-05-04Name : The remote Windows host has an application installed that is affected by mult...
File : imagemagick_7_0_1_1.nasl - Type : ACT_GATHER_INFO
2016-04-01Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-678.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote Fedora host is missing one or more security updates.
File : fedora_2016-49bf88cd29.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
DateInformations
2017-03-02 00:24:21
  • Multiple Updates
2017-03-01 12:03:59
  • Multiple Updates
2017-02-16 00:24:54
  • Multiple Updates
2017-02-06 21:25:20
  • Multiple Updates
2017-02-03 21:26:00
  • Multiple Updates
2016-12-28 13:21:26
  • Multiple Updates
2016-12-25 00:20:54
  • First insertion