The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: Uninitialized variable in coders/mat.c:ReadMATImageV4() allows for memory corruption     (CVE-2018-14551)

  - ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore     component and might lead to denial of service (CVE-2017-1000445)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage     in coders/png.c, related to length calculation and caused by an off-by-one error. (CVE-2017-17879)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Several security vulnerabilities were fixed in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u9.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cineon parsing component in ImageMagick 7.0.8-26     Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a     Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a     check for insufficient image data in a     file.(CVE-2019-11470)

  - In ImageMagick before 7.0.8-8, a NULL pointer     dereference exists in the CheckEventLogging function in     MagickCore/log.c.(CVE-2018-16328)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50     0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of     several minutes during which CPU and memory resources     are consumed until ultimately an attempted large memory     allocation fails. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted file.(CVE-2018-15607)

  - The ReadMATImageV4 function in coders/mat.c in     ImageMagick 7.0.8-7 uses an uninitialized variable,     leading to memory corruption.(CVE-2018-14551)

  - There is a memory leak in the function WriteMSLImage of     coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in     GraphicsMagick before 1.3.31.(CVE-2018-18544)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3785-1 advisory.

    Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick     safely, this update includes a default policy change that disables support for the Postscript and PDF     formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick     policy configuration.

    It was discovered that several memory leaks existed when handling certain images in ImageMagick. An     attacker could use this to cause a denial of service. (CVE-2018-14434, CVE-2018-14435, CVE-2018-14436,     CVE-2018-14437, CVE-2018-16640, CVE-2018-16750)

    It was discovered that ImageMagick did not properly initialize a variable before using it when processing     MAT images. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14551)

    It was discovered that an information disclosure vulnerability existed in ImageMagick when processing XBM     images. An attacker could use this to expose sensitive information. (CVE-2018-16323)

    It was discovered that an out-of-bounds write vulnerability existed in ImageMagick when handling certain     images. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
    (CVE-2018-16642)

    It was discovered that ImageMagick did not properly check for errors in some situations. An attacker could     use this to cause a denial of service. (CVE-2018-16643)

    It was discovered that ImageMagick did not properly validate image meta data in some situations. An     attacker could use this to cause a denial of service. (CVE-2018-16644)

    It was discovered that ImageMagick did not prevent excessive memory allocation when handling certain image     types. An attacker could use this to cause a denial of service. (CVE-2018-16645)

    Sergej Schumilo and Cornelius Aschermann discovered that ImageMagick did not properly check for NULL in     some situations when processing PNG images. An attacker could use this to cause a denial of service.
    (CVE-2018-16749)

    USN-3681-1 fixed vulnerabilities in Imagemagick. Unfortunately, the fix for CVE-2017-13144 introduced a     regression in ImageMagick in Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This update reverts the fix for     CVE-2017-13144 for those releases.

    We apologize for the inconvenience.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199261	RHEL 8 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
139675	Debian DLA-2333-1 : imagemagick security update	Nessus	Debian Local Security Checks	critical
132603	EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1010)	Nessus	Huawei Local Security Checks	critical
117935	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ImageMagick vulnerabilities (USN-3785-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2018-14551

critical

Tenable Plugins

critical

critical

critical

critical