Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: NULL pointer dereference in  GetMagickProperty function in MagickCore/property.c     (CVE-2018-16329)

  - The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted image file. (CVE-2014-8354)

  - PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-     of-bounds read). (CVE-2014-8355)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: Insufficient shell characters filtering (CVE-2016-3714)

  - ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c (CVE-2018-16328)

  - The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper     variable type for the allocation size, which might allow remote attackers to cause a denial of service     (crash) via a crafted PNG file that triggers incorrect memory allocation. (CVE-2012-3437)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: NULL pointer dereference in  GetMagickProperty function in MagickCore/property.c     (CVE-2018-16329)

  - The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper     variable type for the allocation size, which might allow remote attackers to cause a denial of service     (crash) via a crafted PNG file that triggers incorrect memory allocation. (CVE-2012-3437)

  - Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier     allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a     large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than     CVE-2014-2030. (CVE-2014-1947)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Please reference CVE/URL list for details

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3222-1 advisory.

    It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or     automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could     exploit this to cause a denial of service or possibly execute code with the privileges of the user     invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ImageMagick fixes the following issues :

  - CVE-2016-10046: Prevent buffer overflow in draw.c caused     by an incorrect length calculation (bsc#1017308)

  - CVE-2016-10048: Arbitrary module could have been load     because relative path were not escaped (bsc#1017310)

  - CVE-2016-10049: Corrupt RLE files could have overflowed     a buffer due to a incorrect length calculation     (bsc#1017311)

  - CVE-2016-10050: Corrupt RLE files could have overflowed     a heap buffer due to a missing offset check     (bsc#1017312)

  - CVE-2016-10051: Fixed use after free when reading PWP     files (bsc#1017313)

  - CVE-2016-10052: Added bound check to exif parsing of     JPEG files (bsc#1017314)

  - CVE-2016-10059: Unchecked calculation when reading TIFF     files could have lead to a buffer overflow (bsc#1017318)

  - CVE-2016-10060: Improved error handling when writing     files to not mask errors (bsc#1017319)

  - CVE-2016-10061: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10062: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10063: Check validity of extend during TIFF     file reading (bsc#1017320)

  - CVE-2016-10064: Improved checks for buffer overflow when     reading TIFF files (bsc#1017321)

  - CVE-2016-10065: Unchecked calculations when reading VIFF     files could have lead to out of bound reads     (bsc#1017322)

  - CVE-2016-10068: Prevent NULL pointer access when using     the MSL interpreter (bsc#1017324)

  - CVE-2016-10069: Add check for invalid mat file     (bsc#1017325).

  - CVE-2016-10070: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10071: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10144: Added a check after allocating memory     when parsing IPL files (bsc#1020433)

  - CVE-2016-10145: Fixed of-by-one in string copy operation     when parsing WPG files (bsc#1020435)

  - CVE-2016-10146: Captions and labels were handled     incorrectly, causing a memory leak that could have lead     to DoS (bsc#1020443)

  - CVE-2017-5506: Missing offset check leading to a     double-free (bsc#1020436)

  - CVE-2017-5507: Fixed a memory leak when reading MPC     files allowing for DoS (bsc#1020439)

  - CVE-2017-5508: Increase the amount of memory allocated     for TIFF pixels to prevent a heap buffer-overflow     (bsc#1020441)

  - CVE-2017-5510: Prevent out-of-bounds write when reading     PSD files (bsc#1020446).

  - CVE-2017-5511: A missing cast when reading PSD files     could have caused memory corruption by a heap overflow     (bsc#1020448)

This update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421).

This update was imported from the SUSE:SLE-12:Update update project.

This update for ImageMagick fixes the following issues :

  - CVE-2016-10046: Prevent buffer overflow in draw.c caused     by an incorrect length calculation (bsc#1017308)

  - CVE-2016-10048: Arbitrary module could have been load     because relative path were not escaped (bsc#1017310)

  - CVE-2016-10049: Corrupt RLE files could have overflowed     a buffer due to a incorrect length calculation     (bsc#1017311)

  - CVE-2016-10050: Corrupt RLE files could have overflowed     a heap buffer due to a missing offset check     (bsc#1017312)

  - CVE-2016-10051: Fixed use after free when reading PWP     files (bsc#1017313)

  - CVE-2016-10052: Added bound check to exif parsing of     JPEG files (bsc#1017314).

  - CVE-2016-10059: Unchecked calculation when reading TIFF     files could have lead to a buffer overflow (bsc#1017318)

  - CVE-2016-10060: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10063: Check validity of extend during TIFF     file reading (bsc#1017320).

  - CVE-2016-10064: Improved checks for buffer overflow when     reading TIFF files (bsc#1017321)

  - CVE-2016-10065: Unchecked calculations when reading VIFF     files could have lead to out of bound reads     (bsc#1017322)

  - CVE-2016-10068: Prevent NULL pointer access when using     the MSL interpreter (bsc#1017324)

  - CVE-2016-10070: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10071: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326).

  - CVE-2016-10144: Added a check after allocating memory     when parsing IPL files (bsc#1020433).

  - CVE-2016-10145: Fixed of-by-one in string copy operation     when parsing WPG files (bsc#1020435).

  - CVE-2016-10146: Captions and labels were handled     incorrectly, causing a memory leak that could have lead     to DoS (bsc#1020443)

  - CVE-2017-5506: Missing offset check leading to a     double-free (bsc#1020436).

  - CVE-2017-5507: Fixed a memory leak when reading MPC     files allowing for DoS (bsc#1020439).

  - CVE-2017-5508: Increase the amount of memory allocated     for TIFF pixels to prevent a heap buffer-overflow     (bsc#1020441).

  - CVE-2017-5511: A missing cast when reading PSD files     could have caused memory corruption by a heap overflow     (bsc#1020448) This update removes the fix for     CVE-2016-9773. ImageMagick-6 was not affected by     CVE-2016-9773 and it caused a regression (at least in     GraphicsMagick) (bsc#1017421).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, IPL, MPC or PSB files are processed.

This update for ImageMagick fixes the following issues :

  - CVE-2016-10046: Prevent buffer overflow in draw.c caused     by an incorrect length calculation (bsc#1017308)

  - CVE-2016-10048: Arbitrary module could have been load     because relative path were not escaped (bsc#1017310)

  - CVE-2016-10049: Corrupt RLE files could have overflowed     a buffer due to a incorrect length calculation     (bsc#1017311)

  - CVE-2016-10050: Corrupt RLE files could have overflowed     a heap buffer due to a missing offset check     (bsc#1017312)

  - CVE-2016-10051: Fixed use after free when reading PWP     files (bsc#1017313)

  - CVE-2016-10052: Added bound check to exif parsing of     JPEG files (bsc#1017314)

  - CVE-2016-10059: Unchecked calculation when reading TIFF     files could have lead to a buffer overflow (bsc#1017318)

  - CVE-2016-10060: Improved error handling when writing     files to not mask errors (bsc#1017319)

  - CVE-2016-10061: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10062: Improved error handling when writing     files to not mask errors (bsc#1017319).

  - CVE-2016-10063: Check validity of extend during TIFF     file reading (bsc#1017320)

  - CVE-2016-10064: Improved checks for buffer overflow when     reading TIFF files (bsc#1017321)

  - CVE-2016-10065: Unchecked calculations when reading VIFF     files could have lead to out of bound reads     (bsc#1017322)

  - CVE-2016-10068: Prevent NULL pointer access when using     the MSL interpreter (bsc#1017324)

  - CVE-2016-10069: Add check for invalid mat file     (bsc#1017325).

  - CVE-2016-10070: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10071: Prevent allocating the wrong amount of     memory when reading mat files (bsc#1017326)

  - CVE-2016-10144: Added a check after allocating memory     when parsing IPL files (bsc#1020433)

  - CVE-2016-10145: Fixed of-by-one in string copy operation     when parsing WPG files (bsc#1020435)

  - CVE-2016-10146: Captions and labels were handled     incorrectly, causing a memory leak that could have lead     to DoS (bsc#1020443)

  - CVE-2017-5506: Missing offset check leading to a     double-free (bsc#1020436)

  - CVE-2017-5507: Fixed a memory leak when reading MPC     files allowing for DoS (bsc#1020439)

  - CVE-2017-5508: Increase the amount of memory allocated     for TIFF pixels to prevent a heap buffer-overflow     (bsc#1020441)

  - CVE-2017-5510: Prevent out-of-bounds write when reading     PSD files (bsc#1020446).

  - CVE-2017-5511: A missing cast when reading PSD files     could have caused memory corruption by a heap overflow     (bsc#1020448) This update removes the fix for     CVE-2016-9773. ImageMagick-6 was not affected by     CVE-2016-9773 and it caused a regression (at least in     GraphicsMagick) (bsc#1017421).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-09 (ImageMagick: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ImageMagick. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Numerous vulnerabilities were discovered in ImageMagick, an image manipulation program. Issues include memory leaks, out of bound reads and missing checks.

This update also includes an update of the fix for CVE-2016-8677 which was incomplete in the previous version.

For Debian 7 'Wheezy', these problems have been fixed in version 8:6.7.7.10-5+deb7u11.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199283	RHEL 7 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199277	RHEL 5 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199269	RHEL 6 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195362	RHEL 5 : imagemagick (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
135519	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-1390)	Nessus	Huawei Local Security Checks	critical
131846	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-2354)	Nessus	Huawei Local Security Checks	critical
100441	FreeBSD : ImageMagick -- multiple vulnerabilities (50776801-4183-11e7-b291-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
97634	Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-3222-1)	Nessus	Ubuntu Local Security Checks	critical
97562	openSUSE Security Update : ImageMagick (openSUSE-2017-303)	Nessus	SuSE Local Security Checks	critical
97495	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2017:0586-1)	Nessus	SuSE Local Security Checks	critical
97475	Debian DSA-3799-1 : imagemagick - security update	Nessus	Debian Local Security Checks	critical
97317	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:0529-1)	Nessus	SuSE Local Security Checks	critical
97252	GLSA-201702-09 : ImageMagick: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
96882	Debian DLA-807-1 : imagemagick security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-5508

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical