ID CVE-2007-4987 Type cve Reporter NVD Modified 2018-10-15T17:39:21
Description
Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.
{"securityvulns": [{"lastseen": "2018-08-31T11:10:23", "bulletinFamily": "software", "description": "Multiple Vendor ImageMagick Off-By-One Vulnerability\r\n\r\niDefense Security Advisory 09.19.07\r\nhttp://labs.idefense.com/intelligence/vulnerabilities/\r\nSep 19, 2007\r\n\r\nI. BACKGROUND\r\n\r\nImageMagick is a suite of image manipulation tools (animate, composite,\r\nconjure, convert, display, identify, import, mogrify and montage) that\r\nare sometimes used by other applications for processing image files.\r\nFor more information about ImageMagick, visit the vendor's site at the\r\nfollowing URL.\r\n\r\nhttp://www.imagemagick.org/\r\n\r\nII. DESCRIPTION\r\n\r\nRemote exploitation of an off-by-one vulnerability in ImageMagick, as\r\nincluded in various vendors' operating system distributions, allows\r\nattackers to execute arbitrary code.\r\n\r\nThis vulnerability specifically exists in the ReadBlobString() function\r\nin magick/blob.c as shown below.\r\n\r\n 3110 for (i=0; i < (long) MaxTextExtent; i++)\r\n 3111 {\r\n 3112 p=ReadBlobStream(image,1,buffer,&count);\r\n ...\r\n 3119 string[i]=(char) (*p);\r\n 3120 if ((string[i] == '\n') || (string[i] == '\r'))\r\n 3121 break;\r\n 3122 }\r\n 3123 string[i]='\0';\r\n\r\nThe variable "string" is a character array of length "MaxTextExtent". An\r\noff-by-one buffer overflow will occur on line 3123 when "i" is exactly\r\n"MaxTextExtent". This function is called from several image file\r\nprocessing routines. Most of the buffers involved are stack based,\r\nalthough some are on the heap.\r\n\r\nIII. ANALYSIS\r\n\r\nExploitation of this vulnerability allows an attacker to execute\r\narbitrary code in the context of the user.\r\n\r\nOne way of exploiting this vulnerability is to persuade a targeted user\r\nto open a malicious image file with a program that utilizes the\r\nImageMagick library.\r\n\r\nAs the tools that are part of ImageMagick are sometimes used as helper\r\ntools by other applications, this user may be the same as the web\r\nserver user. This scenario is somewhat more severe than the previously\r\ndescribed attack vector since the image processing can occur\r\nautomatically.\r\n\r\nExploitation in stack-based scenarios depends on the stack layout, which\r\ndepends on the compiler and compiler options used to build the library.\r\n\r\nIV. DETECTION\r\n\r\niDefense Labs confirmed that ImageMagick version 6.3.4 is vulnerable. It\r\nis suspected that other versions of ImageMagick are also vulnerable.\r\n\r\nV. WORKAROUND\r\n\r\niDefense is unaware of any effective workaround for this vulnerability.\r\n\r\nVI. VENDOR RESPONSE\r\n\r\nThe ImageMagick maintainers have addressed this vulnerability with the\r\nrelease of version 6.3.5-9. More information is available from the\r\nfollowing URL.\r\n\r\nhttp://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html\r\n\r\nVII. CVE INFORMATION\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\r\nname CVE-2007-4987 to this issue. This is a candidate for inclusion in\r\nthe CVE list (http://cve.mitre.org/), which standardizes names for\r\nsecurity problems.\r\n\r\nVIII. DISCLOSURE TIMELINE\r\n\r\n09/04/2007 Initial vendor notification\r\n09/05/2007 Initial vendor response\r\n09/19/2007 Coordinated public disclosure\r\n\r\nIX. CREDIT\r\n\r\nThis vulnerability was reported to iDefense by regenrecht.\r\n\r\nGet paid for vulnerability research\r\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\r\n\r\nFree tools, research and upcoming events\r\nhttp://labs.idefense.com/\r\n\r\nX. LEGAL NOTICES\r\n\r\nCopyright \u00a9 2007 iDefense, Inc.\r\n\r\nPermission is granted for the redistribution of this alert\r\nelectronically. It may not be edited in any way without the express\r\nwritten consent of iDefense. If you wish to reprint the whole or any\r\npart of this alert in any other medium other than electronically,\r\nplease e-mail customerservice@idefense.com for permission.\r\n\r\nDisclaimer: The information in the advisory is believed to be accurate\r\nat the time of publishing based on currently available information. Use\r\nof the information constitutes acceptance for use in an AS IS condition.\r\n There are no warranties with regard to this information. Neither the\r\nauthor nor the publisher accepts any liability for any direct,\r\nindirect, or consequential loss or damage arising from use of, or\r\nreliance on, this information.", "modified": "2007-09-24T00:00:00", "published": "2007-09-24T00:00:00", "id": "SECURITYVULNS:DOC:18046", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:18046", "title": "iDefense Security Advisory 09.19.07: Multiple Vendor ImageMagick Off-By-One Vulnerability", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:27", "bulletinFamily": "software", "description": "Multiple vulnerabilities on BMP, DCM and another graphics formats parsing.", "modified": "2007-09-24T00:00:00", "published": "2007-09-24T00:00:00", "id": "SECURITYVULNS:VULN:8178", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8178", "title": "ImageMagic multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "seebug": [{"lastseen": "2017-11-19T21:57:39", "bulletinFamily": "exploit", "description": "BUGTRAQ ID: 25766\r\nCVE(CAN) ID: CVE-2007-4987\r\n\r\nImageMagick\u662f\u4e00\u6b3eUnix/Linux\u5e73\u53f0\u4e0b\u5f00\u6e90\u7684\u56fe\u50cf\u67e5\u770b\u548c\u7f16\u8f91\u5de5\u5177\u3002\r\n\r\nImageMagick\u5728\u5904\u7406\u7578\u5f62\u683c\u5f0f\u7684\u6587\u4ef6\u65f6\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u6253\u5f00\u5904\u7406\u6076\u610f\u6587\u4ef6\u63a7\u5236\u7cfb\u7edf\u3002\r\n\r\nmagick/blob.c\u6587\u4ef6\u4e2d\u7684ReadBlobString()\u51fd\u6570\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff1a\r\n\r\n 3110 for (i=0; i < (long) MaxTextExtent; i++)\r\n 3111 {\r\n 3112 p=ReadBlobStream(image,1,buffer,&count);\r\n ...\r\n 3119 string[i]=(char) (*p);\r\n 3120 if ((string[i] == '\\n') || (string[i] == '\\r'))\r\n 3121 break;\r\n 3122 }\r\n 3123 string[i]='\\0';\r\n\r\nstring\u53d8\u91cf\u662fMaxTextExtent\u957f\u5ea6\u7684\u5b57\u7b26\u6570\u7ec4\uff0c\u5982\u679c\u201ci\u201d\u6070\u597d\u4e3aMaxTextExtent\u7684\u8bdd\u5c31\u4f1a\u57283123\u884c\u89e6\u53d1\u5355\u5b57\u8282\u6ea2\u51fa\u3002\u6709\u591a\u4e2a\u56fe\u5f62\u6587\u4ef6\u5904\u7406\u4f8b\u7a0b\u53ef\u4ee5\u89e6\u53d1\u8fd9\u4e2a\u51fd\u6570\uff0c\u5927\u591a\u6570\u60c5\u51b5\u4e0b\u89e6\u53d1\u7684\u90fd\u662f\u6808\u6ea2\u51fa\uff0c\u4f46\u4e5f\u53ef\u80fd\u4e3a\u5806\u6ea2\u51fa\u3002\r\n\r\n\n\nImageMagick ImageMagick < 6.3.5-9\n \u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=\"ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick-6.3.5-10.tar.gz\" target=\"_blank\">ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick-6.3.5-10.tar.gz</a>", "modified": "2007-09-25T00:00:00", "published": "2007-09-25T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-2248", "id": "SSV:2248", "title": "ImageMagick blob.c\u6587\u4ef6\u5355\u5b57\u8282\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e", "type": "seebug", "sourceData": "", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": ""}], "openvas": [{"lastseen": "2017-12-04T11:29:33", "bulletinFamily": "scanner", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-523-1", "modified": "2017-12-01T00:00:00", "published": "2009-03-23T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=840140", "id": "OPENVAS:840140", "title": "Ubuntu Update for imagemagick vulnerabilities USN-523-1", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_523_1.nasl 7969 2017-12-01 09:23:16Z santu $\n#\n# Ubuntu Update for imagemagick vulnerabilities USN-523-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities were found in the image decoders of ImageMagick.\n If a user or automated system were tricked into processing a malicious\n DCM, DIB, XBM, XCF, or XWD image, a remote attacker could execute arbitrary\n code with user privileges.\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-523-1\";\ntag_affected = \"imagemagick vulnerabilities on Ubuntu 6.06 LTS ,\n Ubuntu 6.10 ,\n Ubuntu 7.04\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-523-1/\");\n script_id(840140);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-23 10:59:50 +0100 (Mon, 23 Mar 2009)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"523-1\");\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_name( \"Ubuntu Update for imagemagick vulnerabilities USN-523-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU7.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9c2a\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.06 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9c2a\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.2.4.5-0.6ubuntu0.7\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick++9c2a\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libmagick9\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:10:14", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-20T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=58785", "id": "OPENVAS:58785", "title": "FreeBSD Ports: ImageMagick, ImageMagick-nox11", "type": "openvas", "sourceData": "#\n#VID f5b29ec0-71f9-11dc-8c6a-00304881ac9a\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n ImageMagick\n ImageMagick-nox11\n\n=====\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html\nhttp://www.vuxml.org/freebsd/f5b29ec0-71f9-11dc-8c6a-00304881ac9a.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(58785);\n script_version(\"$Revision: 4118 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-20 07:32:38 +0200 (Tue, 20 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"FreeBSD Ports: ImageMagick, ImageMagick-nox11\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"ImageMagick\");\nif(!isnull(bver) && revcomp(a:bver, b:\"6.3.5.9\")<0) {\n txt += 'Package ImageMagick version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ImageMagick-nox11\");\nif(!isnull(bver) && revcomp(a:bver, b:\"6.3.5.9\")<0) {\n txt += 'Package ImageMagick-nox11 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:14", "bulletinFamily": "scanner", "description": "Check for the Version of ImageMagick", "modified": "2017-07-06T00:00:00", "published": "2009-04-09T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=830377", "id": "OPENVAS:830377", "title": "Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities were discovered in the image decoders\n of ImageMagick. If a user or automated system were tricked into\n processing malicious DCM, DIB, XBM, XCF, or XWD images, a remote\n attacker could execute arbitrary code with user privileges.\n\n The updated packages have been patched to correct these issues.\";\n\ntag_affected = \"ImageMagick on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64,\n Mandriva Linux 2008.0,\n Mandriva Linux 2008.0/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2008-02/msg00005.php\");\n script_id(830377);\n script_version(\"$Revision: 6568 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:04:21 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:26:37 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"MDVSA\", value: \"2008:035\");\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_name( \"Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)\");\n\n script_summary(\"Check for the Version of ImageMagick\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"ImageMagick\", rpm:\"ImageMagick~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-desktop\", rpm:\"ImageMagick-desktop~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-doc\", rpm:\"ImageMagick-doc~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.7.0\", rpm:\"libMagick10.7.0~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.7.0-devel\", rpm:\"libMagick10.7.0-devel~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.7.0\", rpm:\"lib64Magick10.7.0~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.7.0-devel\", rpm:\"lib64Magick10.7.0-devel~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"ImageMagick\", rpm:\"ImageMagick~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-doc\", rpm:\"ImageMagick-doc~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.4.0\", rpm:\"libMagick10.4.0~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.4.0-devel\", rpm:\"libMagick10.4.0-devel~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.4.0\", rpm:\"lib64Magick10.4.0~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.4.0-devel\", rpm:\"lib64Magick10.4.0-devel~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"imagemagick\", rpm:\"imagemagick~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"imagemagick-desktop\", rpm:\"imagemagick-desktop~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"imagemagick-doc\", rpm:\"imagemagick-doc~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libmagick10.7.0\", rpm:\"libmagick10.7.0~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libmagick10.7.0-devel\", rpm:\"libmagick10.7.0-devel~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64magick10.7.0\", rpm:\"lib64magick10.7.0~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64magick10.7.0-devel\", rpm:\"lib64magick10.7.0-devel~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-09T11:41:50", "bulletinFamily": "scanner", "description": "Check for the Version of ImageMagick", "modified": "2018-04-06T00:00:00", "published": "2009-04-09T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830377", "id": "OPENVAS:1361412562310830377", "type": "openvas", "title": "Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities were discovered in the image decoders\n of ImageMagick. If a user or automated system were tricked into\n processing malicious DCM, DIB, XBM, XCF, or XWD images, a remote\n attacker could execute arbitrary code with user privileges.\n\n The updated packages have been patched to correct these issues.\";\n\ntag_affected = \"ImageMagick on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64,\n Mandriva Linux 2008.0,\n Mandriva Linux 2008.0/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2008-02/msg00005.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830377\");\n script_version(\"$Revision: 9370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:53:14 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:26:37 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"MDVSA\", value: \"2008:035\");\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_name( \"Mandriva Update for ImageMagick MDVSA-2008:035 (ImageMagick)\");\n\n script_tag(name:\"summary\", value:\"Check for the Version of ImageMagick\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"ImageMagick\", rpm:\"ImageMagick~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-desktop\", rpm:\"ImageMagick-desktop~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-doc\", rpm:\"ImageMagick-doc~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.7.0\", rpm:\"libMagick10.7.0~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.7.0-devel\", rpm:\"libMagick10.7.0-devel~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.7.0\", rpm:\"lib64Magick10.7.0~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.7.0-devel\", rpm:\"lib64Magick10.7.0-devel~6.3.2.9~5.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"ImageMagick\", rpm:\"ImageMagick~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"ImageMagick-doc\", rpm:\"ImageMagick-doc~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.4.0\", rpm:\"libMagick10.4.0~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libMagick10.4.0-devel\", rpm:\"libMagick10.4.0-devel~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.4.0\", rpm:\"lib64Magick10.4.0~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64Magick10.4.0-devel\", rpm:\"lib64Magick10.4.0-devel~6.2.9.2~1.4mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"imagemagick\", rpm:\"imagemagick~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"imagemagick-desktop\", rpm:\"imagemagick-desktop~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"imagemagick-doc\", rpm:\"imagemagick-doc~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libmagick10.7.0\", rpm:\"libmagick10.7.0~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libmagick10.7.0-devel\", rpm:\"libmagick10.7.0-devel~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-Image-Magick\", rpm:\"perl-Image-Magick~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64magick10.7.0\", rpm:\"lib64magick10.7.0~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64magick10.7.0-devel\", rpm:\"lib64magick10.7.0-devel~6.3.2.9~10.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:11", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200710-27.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=58706", "id": "OPENVAS:58706", "title": "Gentoo Security Advisory GLSA 200710-27 (imagemagick)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities have been discovered in ImageMagick, possibly\nresulting in arbitrary code execution or a Denial of Service.\";\ntag_solution = \"All ImageMagick users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-gfx/imagemagick-6.3.5.10'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200710-27\nhttp://bugs.gentoo.org/show_bug.cgi?id=186030\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200710-27.\";\n\n \n\nif(description)\n{\n script_id(58706);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200710-27 (imagemagick)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"media-gfx/imagemagick\", unaffected: make_list(\"ge 6.3.5.10\"), vulnerable: make_list(\"lt 6.3.5.10\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:37:23", "bulletinFamily": "scanner", "description": "The remote host is missing an update to imagemagick\nannounced via advisory DSA 1858-1.", "modified": "2018-04-06T00:00:00", "published": "2009-08-17T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064637", "id": "OPENVAS:136141256231064637", "title": "Debian Security Advisory DSA 1858-1 (imagemagick)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1858_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory DSA 1858-1 (imagemagick)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities have been discovered in the imagemagick image\nmanipulation programs which can lead to the execution of arbitrary code,\nexposure of sensitive information or cause DoS. The Common Vulnerabilities\nand Exposures project identifies the following problems:\n\nCVE-2007-1667\n\nMultiple integer overflows in XInitImage function in xwd.c for\nImageMagick, allow user-assisted remote attackers to cause a denial of\nservice (crash) or obtain sensitive information via crafted images with\nlarge or negative values that trigger a buffer overflow. It only affects\nthe oldstable distribution (etch).\n\nCVE-2007-1797\n\nMultiple integer overflows allow remote attackers to execute arbitrary\ncode via a crafted DCM image, or the colors or comments field in a\ncrafted XWD image. It only affects the oldstable distribution (etch).\n\nCVE-2007-4985\n\nA crafted image file can trigger an infinite loop in the ReadDCMImage\nfunction or in the ReadXCFImage function. It only affects the oldstable\ndistribution (etch).\n\nCVE-2007-4986\n\nMultiple integer overflows allow context-dependent attackers to execute\narbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file,\nwhich triggers a heap-based buffer overflow. It only affects the\noldstable distribution (etch).\n\nCVE-2007-4987\n\nOff-by-one error allows context-dependent attackers to execute arbitrary\ncode via a crafted image file, which triggers the writing of a '\\0'\ncharacter to an out-of-bounds address. It affects only the oldstable\ndistribution (etch).\n\nCVE-2007-4988\n\nA sign extension error allows context-dependent attackers to execute\narbitrary code via a crafted width value in an image file, which\ntriggers an integer overflow and a heap-based buffer overflow. It\naffects only the oldstable distribution (etch).\n\nCVE-2008-1096\n\nThe load_tile function in the XCF coder allows user-assisted remote\nattackers to cause a denial of service or possibly execute arbitrary\ncode via a crafted .xcf file that triggers an out-of-bounds heap write.\nIt affects only to oldstable (etch).\n\nCVE-2008-1097\n\nHeap-based buffer overflow in the PCX coder allows user-assisted remote\nattackers to cause a denial of service or possibly execute arbitrary\ncode via a crafted .pcx file that triggers incorrect memory allocation\nfor the scanline array, leading to memory corruption. It affects only to\noldstable (etch).\n\nCVE-2009-1882\n\nInteger overflow allows remote attackers to cause a denial of service\n(crash) and possibly execute arbitrary code via a crafted TIFF file,\nwhich triggers a buffer overflow.\n\nFor the old stable distribution (etch), these problems have been fixed in\nversion 7:6.2.4.5.dfsg1-0.15+etch1.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 7:6.3.7.9.dfsg2-1~lenny3.\n\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n7:6.5.1.0-1.1.\n\nWe recommend that you upgrade your imagemagick packages.\";\ntag_summary = \"The remote host is missing an update to imagemagick\nannounced via advisory DSA 1858-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201858-1\";\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64637\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2007-1667\", \"CVE-2007-1797\", \"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\", \"CVE-2008-1096\", \"CVE-2008-1097\", \"CVE-2009-1882\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Debian Security Advisory DSA 1858-1 (imagemagick)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libmagick++9c2a\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++10\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick10\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:05", "bulletinFamily": "scanner", "description": "The remote host is missing an update to imagemagick\nannounced via advisory DSA 1858-1.", "modified": "2017-07-07T00:00:00", "published": "2009-08-17T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64637", "id": "OPENVAS:64637", "title": "Debian Security Advisory DSA 1858-1 (imagemagick)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1858_1.nasl 6615 2017-07-07 12:09:52Z cfischer $\n# Description: Auto-generated from advisory DSA 1858-1 (imagemagick)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities have been discovered in the imagemagick image\nmanipulation programs which can lead to the execution of arbitrary code,\nexposure of sensitive information or cause DoS. The Common Vulnerabilities\nand Exposures project identifies the following problems:\n\nCVE-2007-1667\n\nMultiple integer overflows in XInitImage function in xwd.c for\nImageMagick, allow user-assisted remote attackers to cause a denial of\nservice (crash) or obtain sensitive information via crafted images with\nlarge or negative values that trigger a buffer overflow. It only affects\nthe oldstable distribution (etch).\n\nCVE-2007-1797\n\nMultiple integer overflows allow remote attackers to execute arbitrary\ncode via a crafted DCM image, or the colors or comments field in a\ncrafted XWD image. It only affects the oldstable distribution (etch).\n\nCVE-2007-4985\n\nA crafted image file can trigger an infinite loop in the ReadDCMImage\nfunction or in the ReadXCFImage function. It only affects the oldstable\ndistribution (etch).\n\nCVE-2007-4986\n\nMultiple integer overflows allow context-dependent attackers to execute\narbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file,\nwhich triggers a heap-based buffer overflow. It only affects the\noldstable distribution (etch).\n\nCVE-2007-4987\n\nOff-by-one error allows context-dependent attackers to execute arbitrary\ncode via a crafted image file, which triggers the writing of a '\\0'\ncharacter to an out-of-bounds address. It affects only the oldstable\ndistribution (etch).\n\nCVE-2007-4988\n\nA sign extension error allows context-dependent attackers to execute\narbitrary code via a crafted width value in an image file, which\ntriggers an integer overflow and a heap-based buffer overflow. It\naffects only the oldstable distribution (etch).\n\nCVE-2008-1096\n\nThe load_tile function in the XCF coder allows user-assisted remote\nattackers to cause a denial of service or possibly execute arbitrary\ncode via a crafted .xcf file that triggers an out-of-bounds heap write.\nIt affects only to oldstable (etch).\n\nCVE-2008-1097\n\nHeap-based buffer overflow in the PCX coder allows user-assisted remote\nattackers to cause a denial of service or possibly execute arbitrary\ncode via a crafted .pcx file that triggers incorrect memory allocation\nfor the scanline array, leading to memory corruption. It affects only to\noldstable (etch).\n\nCVE-2009-1882\n\nInteger overflow allows remote attackers to cause a denial of service\n(crash) and possibly execute arbitrary code via a crafted TIFF file,\nwhich triggers a buffer overflow.\n\nFor the old stable distribution (etch), these problems have been fixed in\nversion 7:6.2.4.5.dfsg1-0.15+etch1.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 7:6.3.7.9.dfsg2-1~lenny3.\n\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n7:6.5.1.0-1.1.\n\nWe recommend that you upgrade your imagemagick packages.\";\ntag_summary = \"The remote host is missing an update to imagemagick\nannounced via advisory DSA 1858-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201858-1\";\n\n\nif(description)\n{\n script_id(64637);\n script_version(\"$Revision: 6615 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:52 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2007-1667\", \"CVE-2007-1797\", \"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\", \"CVE-2008-1096\", \"CVE-2008-1097\", \"CVE-2009-1882\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Debian Security Advisory DSA 1858-1 (imagemagick)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libmagick++9c2a\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9\", ver:\"6.2.4.5.dfsg1-0.15+etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++10\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick9-dev\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick10\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"imagemagick\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libmagick++9-dev\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"perlmagick\", ver:\"6.3.7.9.dfsg2-1~lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2019-02-21T01:10:15", "bulletinFamily": "scanner", "description": "This update of ImageMagick fixes several vulnerabilities.\n\n - CVE-2007-4985: infinite loop while parsing images\n\n - CVE-2007-4986: integer overflows that can lead to code execution\n\n - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected)\n\n - CVE-2007-4988: integer overflows that can lead to code execution", "modified": "2018-07-19T00:00:00", "id": "SUSE_IMAGEMAGICK-4543.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=27604", "published": "2007-11-01T00:00:00", "title": "openSUSE 10 Security Update : ImageMagick (ImageMagick-4543)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update ImageMagick-4543.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(27604);\n script_version (\"1.9\");\n script_cvs_date(\"Date: 2018/07/19 23:54:24\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n\n script_name(english:\"openSUSE 10 Security Update : ImageMagick (ImageMagick-4543)\");\n script_summary(english:\"Check for the ImageMagick-4543 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of ImageMagick fixes several vulnerabilities.\n\n - CVE-2007-4985: infinite loop while parsing images\n\n - CVE-2007-4986: integer overflows that can lead to code\n execution\n\n - CVE-2007-4987: one-byte buffer overflow that can lead to\n code execution (SLES8- and SLES9-based products are not\n affected)\n\n - CVE-2007-4988: integer overflows that can lead to code\n execution\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected ImageMagick packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:ImageMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:ImageMagick-Magick++\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:ImageMagick-Magick++-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:ImageMagick-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:perl-PerlMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.1|SUSE10\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.1 / 10.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.1\", reference:\"ImageMagick-6.2.5-16.26\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"ImageMagick-Magick++-6.2.5-16.26\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"ImageMagick-Magick++-devel-6.2.5-16.26\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"ImageMagick-devel-6.2.5-16.26\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"perl-PerlMagick-6.2.5-16.26\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"ImageMagick-6.3.0.0-27.8\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"ImageMagick-Magick++-6.3.0.0-27.8\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"ImageMagick-Magick++-devel-6.3.0.0-27.8\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"ImageMagick-devel-6.3.0.0-27.8\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"perl-PerlMagick-6.3.0.0-27.8\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ImageMagick\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:10:23", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities were found in the image decoders of ImageMagick. If a user or automated system were tricked into processing a malicious DCM, DIB, XBM, XCF, or XWD image, a remote attacker could execute arbitrary code with user privileges.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "modified": "2018-11-28T00:00:00", "id": "UBUNTU_USN-523-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=28128", "published": "2007-11-10T00:00:00", "title": "Ubuntu 6.06 LTS / 6.10 / 7.04 : imagemagick vulnerabilities (USN-523-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-523-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(28128);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/11/28 11:42:05\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_bugtraq_id(25763, 25764, 25765, 25766);\n script_xref(name:\"USN\", value:\"523-1\");\n\n script_name(english:\"Ubuntu 6.06 LTS / 6.10 / 7.04 : imagemagick vulnerabilities (USN-523-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities were found in the image decoders of\nImageMagick. If a user or automated system were tricked into\nprocessing a malicious DCM, DIB, XBM, XCF, or XWD image, a remote\nattacker could execute arbitrary code with user privileges.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/523-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:imagemagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmagick++9-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmagick++9c2a\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmagick9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libmagick9-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:perlmagick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.06:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:7.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2007-2018 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(6\\.06|6\\.10|7\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 6.06 / 6.10 / 7.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"6.06\", pkgname:\"imagemagick\", pkgver:\"6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libmagick++9-dev\", pkgver:\"6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libmagick++9c2a\", pkgver:\"6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libmagick9\", pkgver:\"6:6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libmagick9-dev\", pkgver:\"6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"perlmagick\", pkgver:\"6.2.4.5-0.6ubuntu0.7\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"imagemagick\", pkgver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"libmagick++9-dev\", pkgver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"libmagick++9c2a\", pkgver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"libmagick9\", pkgver:\"7:6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"libmagick9-dev\", pkgver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"perlmagick\", pkgver:\"6.2.4.5.dfsg1-0.10ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"imagemagick\", pkgver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"libmagick++9-dev\", pkgver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"libmagick++9c2a\", pkgver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"libmagick9\", pkgver:\"7:6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"libmagick9-dev\", pkgver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"perlmagick\", pkgver:\"6.2.4.5.dfsg1-0.14ubuntu0.2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"imagemagick / libmagick++9-dev / libmagick++9c2a / libmagick9 / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:11:45", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities were discovered in the image decoders of ImageMagick. If a user or automated system were tricked into processing malicious DCM, DIB, XBM, XCF, or XWD images, a remote attacker could execute arbitrary code with user privileges.\n\nThe updated packages have been patched to correct these issues.", "modified": "2018-07-19T00:00:00", "id": "MANDRIVA_MDVSA-2008-035.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=37331", "published": "2009-04-23T00:00:00", "title": "Mandriva Linux Security Advisory : ImageMagick (MDVSA-2008:035)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2008:035. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(37331);\n script_version (\"1.13\");\n script_cvs_date(\"Date: 2018/07/19 20:59:15\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_xref(name:\"MDVSA\", value:\"2008:035\");\n\n script_name(english:\"Mandriva Linux Security Advisory : ImageMagick (MDVSA-2008:035)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities were discovered in the image decoders of\nImageMagick. If a user or automated system were tricked into\nprocessing malicious DCM, DIB, XBM, XCF, or XWD images, a remote\nattacker could execute arbitrary code with user privileges.\n\nThe updated packages have been patched to correct these issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ImageMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ImageMagick-desktop\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ImageMagick-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:imagemagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:imagemagick-desktop\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:imagemagick-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64Magick10.4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64Magick10.4.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64Magick10.7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64Magick10.7.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64magick10.7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64magick10.7.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libMagick10.4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libMagick10.4.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libMagick10.7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libMagick10.7.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libmagick10.7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libmagick10.7.0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:perl-Image-Magick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.0\", reference:\"ImageMagick-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"ImageMagick-doc-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64Magick10.4.0-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64Magick10.4.0-devel-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libMagick10.4.0-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libMagick10.4.0-devel-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"perl-Image-Magick-6.2.9.2-1.4mdv2007.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2007.1\", reference:\"ImageMagick-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"ImageMagick-desktop-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"ImageMagick-doc-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64Magick10.7.0-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64Magick10.7.0-devel-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libMagick10.7.0-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libMagick10.7.0-devel-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"perl-Image-Magick-6.3.2.9-5.2mdv2007.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.0\", reference:\"imagemagick-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"imagemagick-desktop-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"imagemagick-doc-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64magick10.7.0-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64magick10.7.0-devel-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libmagick10.7.0-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libmagick10.7.0-devel-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"perl-Image-Magick-6.3.2.9-10.1mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:10:06", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities have been discovered in ImageMagick.\n\nImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.\n\nMultiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.\n\nOff-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\\0' character to an out-of-bounds address.\n\nSign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.", "modified": "2018-11-10T00:00:00", "id": "FREEBSD_PKG_F5B29EC071F911DC8C6A00304881AC9A.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=26978", "published": "2007-10-12T00:00:00", "title": "FreeBSD : ImageMagick -- multiple vulnerabilities (f5b29ec0-71f9-11dc-8c6a-00304881ac9a)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(26978);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/11/10 11:49:41\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n\n script_name(english:\"FreeBSD : ImageMagick -- multiple vulnerabilities (f5b29ec0-71f9-11dc-8c6a-00304881ac9a)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities have been discovered in ImageMagick.\n\nImageMagick before 6.3.5-9 allows context-dependent attackers to cause\na denial of service via a crafted image file that triggers (1) an\ninfinite loop in the ReadDCMImage function, related to ReadBlobByte\nfunction calls; or (2) an infinite loop in the ReadXCFImage function,\nrelated to ReadBlobMSBLong function calls.\n\nMultiple integer overflows in ImageMagick before 6.3.5-9 allow\ncontext-dependent attackers to execute arbitrary code via a crafted\n(1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which\ntriggers a heap-based buffer overflow.\n\nOff-by-one error in the ReadBlobString function in blob.c in\nImageMagick before 6.3.5-9 allows context-dependent attackers to\nexecute arbitrary code via a crafted image file, which triggers the\nwriting of a '\\0' character to an out-of-bounds address.\n\nSign extension error in the ReadDIBImage function in ImageMagick\nbefore 6.3.5-9 allows context-dependent attackers to execute arbitrary\ncode via a crafted width value in an image file, which triggers an\ninteger overflow and a heap-based buffer overflow.\"\n );\n # http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5a73507c\"\n );\n # https://vuxml.freebsd.org/freebsd/f5b29ec0-71f9-11dc-8c6a-00304881ac9a.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?78bded67\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ImageMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ImageMagick-nox11\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/09/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/10/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"ImageMagick<6.3.5.9\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ImageMagick-nox11<6.3.5.9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:10:15", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200710-27 (ImageMagick: Multiple vulnerabilities)\n\n regenrecht reported multiple infinite loops in functions ReadDCMImage() and ReadXCFImage() (CVE-2007-4985), multiple integer overflows when handling certain types of images (CVE-2007-4986, CVE-2007-4988), and an off-by-one error in the ReadBlobString() function (CVE-2007-4987).\n Impact :\n\n A remote attacker could entice a user to open a specially crafted image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or an excessive CPU consumption. Note that applications relying on ImageMagick to process images can also trigger the vulnerability.\n Workaround :\n\n There is no known workaround at this time.", "modified": "2018-08-10T00:00:00", "id": "GENTOO_GLSA-200710-27.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=27559", "published": "2007-10-25T00:00:00", "title": "GLSA-200710-27 : ImageMagick: Multiple vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200710-27.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(27559);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/08/10 18:07:07\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n script_xref(name:\"GLSA\", value:\"200710-27\");\n\n script_name(english:\"GLSA-200710-27 : ImageMagick: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200710-27\n(ImageMagick: Multiple vulnerabilities)\n\n regenrecht reported multiple infinite loops in functions ReadDCMImage()\n and ReadXCFImage() (CVE-2007-4985), multiple integer overflows when\n handling certain types of images (CVE-2007-4986, CVE-2007-4988), and an\n off-by-one error in the ReadBlobString() function (CVE-2007-4987).\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted\n image, possibly resulting in the remote execution of arbitrary code\n with the privileges of the user running the application, or an\n excessive CPU consumption. Note that applications relying on\n ImageMagick to process images can also trigger the vulnerability.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200710-27\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All ImageMagick users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-gfx/imagemagick-6.3.5.10'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:imagemagick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/10/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-gfx/imagemagick\", unaffected:make_list(\"ge 6.3.5.10\"), vulnerable:make_list(\"lt 6.3.5.10\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"ImageMagick\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:10:30", "bulletinFamily": "scanner", "description": "This update of ImageMagick fixes several vulnerabilities.\n\n - infinite loop while parsing images. (CVE-2007-4985)\n\n - integer overflows that can lead to code execution.\n (CVE-2007-4986)\n\n - one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected).\n (CVE-2007-4987)\n\n - integer overflows that can lead to code execution.\n (CVE-2007-4988)", "modified": "2016-12-22T00:00:00", "id": "SUSE_IMAGEMAGICK-4541.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=29353", "published": "2007-12-13T00:00:00", "title": "SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 4541)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(29353);\n script_version (\"$Revision: 1.12 $\");\n script_cvs_date(\"$Date: 2016/12/22 20:32:46 $\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n\n script_name(english:\"SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 4541)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 10 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of ImageMagick fixes several vulnerabilities.\n\n - infinite loop while parsing images. (CVE-2007-4985)\n\n - integer overflows that can lead to code execution.\n (CVE-2007-4986)\n\n - one-byte buffer overflow that can lead to code execution\n (SLES8- and SLES9-based products are not affected).\n (CVE-2007-4987)\n\n - integer overflows that can lead to code execution.\n (CVE-2007-4988)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4985.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4986.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4987.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4988.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply ZYPP patch number 4541.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/12/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 10 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"ImageMagick-6.2.5-16.26\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"ImageMagick-Magick++-6.2.5-16.26\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"ImageMagick-devel-6.2.5-16.26\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"perl-PerlMagick-6.2.5-16.26\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:10:15", "bulletinFamily": "scanner", "description": "This update of GraphicsMagick fixes several vulnerabilities.\n\n - CVE-2007-4985: infinite loop while parsing images\n\n - CVE-2007-4986: integer overflows that can lead to code execution\n\n - CVE-2007-4987: one-byte buffer overflow that can lead to code execution\n\n - CVE-2007-4988: integer overflows that can lead to code execution", "modified": "2016-12-22T00:00:00", "id": "SUSE_GRAPHICSMAGICK-4539.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=27603", "published": "2007-11-01T00:00:00", "title": "openSUSE 10 Security Update : GraphicsMagick (GraphicsMagick-4539)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update GraphicsMagick-4539.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(27603);\n script_version (\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2016/12/22 20:32:46 $\");\n\n script_cve_id(\"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\");\n\n script_name(english:\"openSUSE 10 Security Update : GraphicsMagick (GraphicsMagick-4539)\");\n script_summary(english:\"Check for the GraphicsMagick-4539 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of GraphicsMagick fixes several vulnerabilities.\n\n - CVE-2007-4985: infinite loop while parsing images\n\n - CVE-2007-4986: integer overflows that can lead to code\n execution\n\n - CVE-2007-4987: one-byte buffer overflow that can lead to\n code execution\n\n - CVE-2007-4988: integer overflows that can lead to code\n execution\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected GraphicsMagick packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:GraphicsMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:GraphicsMagick-c++\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:GraphicsMagick-c++-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:GraphicsMagick-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libGraphicsMagick++-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libGraphicsMagick++1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libGraphicsMagick1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libGraphicsMagickWand0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:perl-GraphicsMagick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.2|SUSE10\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.2 / 10.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.2\", reference:\"GraphicsMagick-1.1.7-35.5\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"GraphicsMagick-c++-1.1.7-35.5\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"GraphicsMagick-c++-devel-1.1.7-35.5\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"GraphicsMagick-devel-1.1.7-35.5\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"perl-GraphicsMagick-1.1.7-35.5\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"GraphicsMagick-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"GraphicsMagick-devel-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libGraphicsMagick++-devel-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libGraphicsMagick++1-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libGraphicsMagick1-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libGraphicsMagickWand0-1.1.8-20.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"perl-GraphicsMagick-1.1.8-20.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"GraphicsMagick\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:13:04", "bulletinFamily": "scanner", "description": "Several vulnerabilities have been discovered in the imagemagick image manipulation programs which can lead to the execution of arbitrary code, exposure of sensitive information or cause DoS. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2007-1667 Multiple integer overflows in XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow. It only affects the oldstable distribution (etch).\n\n - CVE-2007-1797 Multiple integer overflows allow remote attackers to execute arbitrary code via a crafted DCM image, or the colors or comments field in a crafted XWD image. It only affects the oldstable distribution (etch).\n\n - CVE-2007-4985 A crafted image file can trigger an infinite loop in the ReadDCMImage function or in the ReadXCFImage function.\n It only affects the oldstable distribution (etch).\n\n - CVE-2007-4986 Multiple integer overflows allow context-dependent attackers to execute arbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file, which triggers a heap-based buffer overflow. It only affects the oldstable distribution (etch).\n\n - CVE-2007-4987 Off-by-one error allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\\0' character to an out-of-bounds address. It affects only the oldstable distribution (etch).\n\n - CVE-2007-4988 A sign extension error allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow. It affects only the oldstable distribution (etch).\n\n - CVE-2008-1096 The load_tile function in the XCF coder allows user-assisted remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write. It affects only to oldstable (etch).\n\n - CVE-2008-1097 Heap-based buffer overflow in the PCX coder allows user-assisted remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted .pcx file that triggers incorrect memory allocation for the scanline array, leading to memory corruption. It affects only to oldstable (etch).\n\n - CVE-2009-1882 Integer overflow allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow.", "modified": "2018-11-10T00:00:00", "id": "DEBIAN_DSA-1858.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=44723", "published": "2010-02-24T00:00:00", "title": "Debian DSA-1858-1 : imagemagick - multiple vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1858. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44723);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/11/10 11:49:34\");\n\n script_cve_id(\"CVE-2007-1667\", \"CVE-2007-1797\", \"CVE-2007-4985\", \"CVE-2007-4986\", \"CVE-2007-4987\", \"CVE-2007-4988\", \"CVE-2008-1096\", \"CVE-2008-1097\", \"CVE-2009-1882\");\n script_bugtraq_id(23300, 23347, 25763, 25764, 25765, 25766, 28821, 28822, 35111);\n script_xref(name:\"DSA\", value:\"1858\");\n\n script_name(english:\"Debian DSA-1858-1 : imagemagick - multiple vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the imagemagick image\nmanipulation programs which can lead to the execution of arbitrary\ncode, exposure of sensitive information or cause DoS. The Common\nVulnerabilities and Exposures project identifies the following\nproblems :\n\n - CVE-2007-1667\n Multiple integer overflows in XInitImage function in\n xwd.c for ImageMagick, allow user-assisted remote\n attackers to cause a denial of service (crash) or obtain\n sensitive information via crafted images with large or\n negative values that trigger a buffer overflow. It only\n affects the oldstable distribution (etch).\n\n - CVE-2007-1797\n Multiple integer overflows allow remote attackers to\n execute arbitrary code via a crafted DCM image, or the\n colors or comments field in a crafted XWD image. It only\n affects the oldstable distribution (etch).\n\n - CVE-2007-4985\n A crafted image file can trigger an infinite loop in the\n ReadDCMImage function or in the ReadXCFImage function.\n It only affects the oldstable distribution (etch).\n\n - CVE-2007-4986\n Multiple integer overflows allow context-dependent\n attackers to execute arbitrary code via a crafted .dcm,\n .dib, .xbm, .xcf, or .xwd image file, which triggers a\n heap-based buffer overflow. It only affects the\n oldstable distribution (etch).\n\n - CVE-2007-4987\n Off-by-one error allows context-dependent attackers to\n execute arbitrary code via a crafted image file, which\n triggers the writing of a '\\0' character to an\n out-of-bounds address. It affects only the oldstable\n distribution (etch).\n\n - CVE-2007-4988\n A sign extension error allows context-dependent\n attackers to execute arbitrary code via a crafted width\n value in an image file, which triggers an integer\n overflow and a heap-based buffer overflow. It affects\n only the oldstable distribution (etch).\n\n - CVE-2008-1096\n The load_tile function in the XCF coder allows\n user-assisted remote attackers to cause a denial of\n service or possibly execute arbitrary code via a crafted\n .xcf file that triggers an out-of-bounds heap write. It\n affects only to oldstable (etch).\n\n - CVE-2008-1097\n Heap-based buffer overflow in the PCX coder allows\n user-assisted remote attackers to cause a denial of\n service or possibly execute arbitrary code via a crafted\n .pcx file that triggers incorrect memory allocation for\n the scanline array, leading to memory corruption. It\n affects only to oldstable (etch).\n\n - CVE-2009-1882\n Integer overflow allows remote attackers to cause a\n denial of service (crash) and possibly execute arbitrary\n code via a crafted TIFF file, which triggers a buffer\n overflow.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=418057\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412945\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444267\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530838\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-1667\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-1797\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-4985\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-4986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-4987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-4988\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-1096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-1097\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-1882\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1858\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the imagemagick packages.\n\nFor the old stable distribution (etch), these problems have been fixed\nin version 7:6.2.4.5.dfsg1-0.15+etch1.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 7:6.3.7.9.dfsg2-1~lenny3.\n\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n7:6.5.1.0-1.1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:imagemagick\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/08/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"4.0\", prefix:\"imagemagick\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"libmagick++9-dev\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"libmagick++9c2a\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"libmagick9\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"libmagick9-dev\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"perlmagick\", reference:\"7:6.2.4.5.dfsg1-0.15+etch1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"imagemagick\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmagick++10\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmagick++9-dev\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmagick10\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmagick9-dev\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"perlmagick\", reference:\"7:6.3.7.9.dfsg2-1~lenny3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:27", "bulletinFamily": "unix", "description": "### Background\n\nImageMagick is a collection of tools and libraries for manipulating various image formats. \n\n### Description\n\nregenrecht reported multiple infinite loops in functions ReadDCMImage() and ReadXCFImage() (CVE-2007-4985), multiple integer overflows when handling certain types of images (CVE-2007-4986, CVE-2007-4988), and an off-by-one error in the ReadBlobString() function (CVE-2007-4987). \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or an excessive CPU consumption. Note that applications relying on ImageMagick to process images can also trigger the vulnerability. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll ImageMagick users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-gfx/imagemagick-6.3.5.10\"", "modified": "2007-10-24T00:00:00", "published": "2007-10-24T00:00:00", "id": "GLSA-200710-27", "href": "https://security.gentoo.org/glsa/200710-27", "type": "gentoo", "title": "ImageMagick: Multiple vulnerabilities", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "freebsd": [{"lastseen": "2018-08-31T01:15:38", "bulletinFamily": "unix", "description": "\nMultiple vulnerabilities have been discovered in ImageMagick.\n\nImageMagick before 6.3.5-9 allows context-dependent attackers\n\t to cause a denial of service via a crafted image file that\n\t triggers (1) an infinite loop in the ReadDCMImage function,\n\t related to ReadBlobByte function calls; or (2) an infinite\n\t loop in the ReadXCFImage function, related to ReadBlobMSBLong\n\t function calls.\n\n\nMultiple integer overflows in ImageMagick before 6.3.5-9\n\t allow context-dependent attackers to execute arbitrary code\n\t via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5)\n\t .xwd image file, which triggers a heap-based buffer overflow.\n\n\nOff-by-one error in the ReadBlobString function in blob.c in\n\t ImageMagick before 6.3.5-9 allows context-dependent attackers\n\t to execute arbitrary code via a crafted image file, which\n\t triggers the writing of a '\\0' character to an out-of-bounds\n\t address.\n\n\nSign extension error in the ReadDIBImage function in\n\t ImageMagick before 6.3.5-9 allows context-dependent attackers\n\t to execute arbitrary code via a crafted width value in an\n\t image file, which triggers an integer overflow and a\n\t heap-based buffer overflow.\n\n", "modified": "2007-09-19T00:00:00", "published": "2007-09-19T00:00:00", "id": "F5B29EC0-71F9-11DC-8C6A-00304881AC9A", "href": "https://vuxml.freebsd.org/freebsd/f5b29ec0-71f9-11dc-8c6a-00304881ac9a.html", "title": "ImageMagick -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:09:47", "bulletinFamily": "unix", "description": "Multiple vulnerabilities were found in the image decoders of ImageMagick. If a user or automated system were tricked into processing a malicious DCM, DIB, XBM, XCF, or XWD image, a remote attacker could execute arbitrary code with user privileges.", "modified": "2007-10-03T00:00:00", "published": "2007-10-03T00:00:00", "id": "USN-523-1", "href": "https://usn.ubuntu.com/523-1/", "title": "ImageMagick vulnerabilities", "type": "ubuntu", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "debian": [{"lastseen": "2018-10-16T22:14:38", "bulletinFamily": "unix", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1858-1 security@debian.org\nhttp://www.debian.org/security/ Luciano Bello\nAugust 10, 2009 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : imagemagick\nVulnerability : multiple\nProblem type : local(remote)\nDebian-specific: no\nCVE Id(s) : CVE-2007-1667 CVE-2007-1797 CVE-2007-4985 CVE-2007-4986 \n CVE-2007-4987 CVE-2007-4988 CVE-2008-1096 CVE-2008-1097\n CVE-2009-1882\nDebian Bug : 418057 412945 444267 530838\n\nSeveral vulnerabilities have been discovered in the imagemagick image\nmanipulation programs which can lead to the execution of arbitrary code,\nexposure of sensitive information or cause DoS. The Common Vulnerabilities\nand Exposures project identifies the following problems:\n\nCVE-2007-1667\n\t\n Multiple integer overflows in XInitImage function in xwd.c for\n ImageMagick, allow user-assisted remote attackers to cause a\tdenial of\n service (crash) or obtain sensitive information via crafted images with\n large or negative values that trigger a buffer overflow. It only affects\n the oldstable distribution (etch).\n\nCVE-2007-1797\n\n Multiple integer overflows allow remote attackers to execute arbitrary\n code via a crafted DCM image, or the colors or comments field in a \n crafted XWD image. It only affects the oldstable distribution (etch).\n\nCVE-2007-4985\n\n A crafted image file can trigger an infinite loop in the ReadDCMImage\n function or in the ReadXCFImage function. It only affects the oldstable\n distribution (etch).\n\nCVE-2007-4986\n\n Multiple integer overflows allow context-dependent attackers to execute\n arbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file,\n which triggers a heap-based buffer overflow. It only affects the \n oldstable distribution (etch).\n\nCVE-2007-4987\n\n Off-by-one error allows context-dependent attackers to execute arbitrary\n code via a crafted image file, which triggers the writing of a '\\0'\n character to an out-of-bounds address. It affects only the oldstable\n distribution (etch).\n\nCVE-2007-4988\n\n A sign extension error allows context-dependent attackers to execute \n arbitrary code via a crafted width value in an image file, which \n triggers an integer overflow and a heap-based buffer overflow. It \n affects only the oldstable distribution (etch).\n\nCVE-2008-1096\n\n The load_tile function in the XCF coder allows user-assisted remote\n attackers to cause a denial of service or possibly execute arbitrary \n code via a crafted .xcf file that triggers an out-of-bounds heap write.\n It affects only to oldstable (etch).\n\nCVE-2008-1097\n\n Heap-based buffer overflow in the PCX coder allows user-assisted remote\n attackers to cause a denial of service or possibly execute arbitrary \n code via a crafted .pcx file that triggers incorrect memory allocation \n for the scanline array, leading to memory corruption. It affects only to\n oldstable (etch).\n\nCVE-2009-1882\n\n Integer overflow allows remote attackers to cause a denial of service\n (crash) and possibly execute arbitrary code via a crafted TIFF file, \n which triggers a buffer overflow.\n\nFor the old stable distribution (etch), these problems have been fixed in\nversion 7:6.2.4.5.dfsg1-0.15+etch1.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 7:6.3.7.9.dfsg2-1~lenny3.\n\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n7:6.5.1.0-1.1.\n\nWe recommend that you upgrade your imagemagick packages.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nOldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1.tar.gz\n Size/MD5 checksum: 5202678 cbb51d6956c6dd68f7dfaa068d0b416b\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1.dsc\n Size/MD5 checksum: 958 6c8ffe1f0d0efab6652070aabd8fab8d\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 189542 1aa917c2f494952622bcd089655f7b3b\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 2449862 be4d146061a0211fc3070c8461c43539\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 743324 75350c6eb5143f5dee7fe31a01e9a410\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 174690 d024ad2524f15fa889df8e34f3a900ae\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 305632 0e5fea24e12ad7b5951ffb24d01f5a50\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_alpha.deb\n Size/MD5 checksum: 1391130 8ad3f625613017b1ff977d319feddf7c\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 744738 78e3cfa4a31075f823bc28403f5d67c5\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 248658 6bb3f532d90ed4cdd7ca59d9cebfe701\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 172718 600e69985df7aef9e5fd776fdfc3b738\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 1676998 c713077e98f9176de77ce5c58f00d2bc\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 1324236 ce92217fb065842e2ab9a7f3ac970e55\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_amd64.deb\n Size/MD5 checksum: 173408 98e699079a51b04a90c3f40792b9be80\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 1626758 5186c4434b3545b12abefa15fb7b470e\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 750528 88d58370346dcfbdb7ffd8496ef8ec4c\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 170052 c461b7b5306e32f2dc385fbdf52c5d7f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 1342082 edd1fce3588b7c32fb78d2a8eaa1c0c2\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 247980 603ec16ac3c1306d41856cf536930a96\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_arm.deb\n Size/MD5 checksum: 160332 fd405cbc70e2918901df36286cf9d666\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 746376 c004fb6755320fe156bdeea5f0a7c59e\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 183142 4a95a974b46d027c2de2850c698515d1\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 2055750 1b2da69dc17f5501146203e7ac10223d\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 1495548 8760765e809da00d35f4aa39f8417f46\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 198210 57cc94c9786b84365cad988df21dac05\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_hppa.deb\n Size/MD5 checksum: 286134 910570702fda0378973650315eff0b65\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 745936 1e40ed75296c5446e7f827662cb2490a\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 1640482 fe033745104b08e6ac962a1eef3332f7\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 179658 87d4d44a22cfed4283420a0d58b33c20\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 170978 64b62cf6a14fdb016f2175d2f2944977\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 229176 8b431753808c82a4b4b537aa964dd558\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_i386.deb\n Size/MD5 checksum: 1299682 73e5155f242af1d2d16e2e4458d9539f\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 205920 ad4d2d775f95da68f24321ff75734962\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 1834728 30e0b78747581fc10b33cc4fa35e8f6f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 321316 47b87d4b5338ca999b3f7451c311de09\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 2490906 cad083bd9ede9fbf3b3bfa14d3a2ea61\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 198376 94cf7ae07c223a1f500293f9caf20940\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_ia64.deb\n Size/MD5 checksum: 741428 a55baa17258cd8a63b0fb3be44a0db4d\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 142952 b1352f4d11ebb3f7aa8e9b00e7ef8fe2\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 275890 2df971bab450e39c4fad12d54e0fe7db\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 752374 2fb624ff0a45ca9caf2236be7dcd3d83\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 175760 f71be7b0921aeca25c29b46cda2cd9e2\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 2055384 b8f65bf7cda5ee0453b2423e023cb253\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_mips.deb\n Size/MD5 checksum: 1266780 7bdeee5dfa4574ed71d8f87c01ae9289\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 142900 9ece29fcb2571d154f2784087191527e\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 740304 7df92dc094e334616277130e1f99003c\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 268500 a6e33f71964d78f912ec62368741fcd4\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 1257890 950314430566c9c0caa36b1f490d4c09\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 2027730 2c670703f9258a1f8c7d6d4ffd908946\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_mipsel.deb\n Size/MD5 checksum: 169860 30ec4ba83a713e1d67cfff990acc6076\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 753702 dd63dea258aa7c9238e5e0e23ff967ef\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 1913062 9e21aef4686620ef9a4c80320622e2ec\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 253638 85ed0945b741ad5a67ddac348f5c75e0\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 175528 d421ef576cee1579b7268ba85fcdbf6f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 1293220 c585cb718dde59b7fdad61919885bd64\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_powerpc.deb\n Size/MD5 checksum: 170726 62c31b47961aa0a88035332005fb47fd\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 1811074 7316a4ff8c9bdc0e670465fd9f05093b\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9c2a_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 178722 3f4cb9bb91d393fb9cf0424442878a56\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 1349492 8f4b9bbe16aed899986209a6caf01e12\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 171346 c33190150654346ca72f3c90d90460aa\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 231394 a9ee8c289492d1a9fa71ed46c5fdcc11\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.2.4.5.dfsg1-0.15+etch1_sparc.deb\n Size/MD5 checksum: 744650 a1d3355e29a0a19e53af26614973343f\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2.orig.tar.gz\n Size/MD5 checksum: 8227844 14425de4d5d78b7726973af967e1f9e6\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3.dsc\n Size/MD5 checksum: 1714 22f4afd84d6362ebceb44ceaead527b9\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3.diff.gz\n Size/MD5 checksum: 88277 49ac2394a701ce7bf273dfa76d27b24d\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 181968 3aadc707b9192b7c039de7a72932111b\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 1898628 107d3ef6054b0a589091ceeb4340f6ab\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 4628066 37e0318f146d4313a918b25cc671f160\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 1432042 ac62088a4c997808728056ac925faf97\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 267382 d1379dee6ffc48a1efaaa3c2fe70808a\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_alpha.deb\n Size/MD5 checksum: 171210 8dae3357eab41498de07aa7d88ed4579\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 218116 709bfbffb93bd84a08a8db7b21415ad1\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 4262726 f9a3cefff5e0821aa125a4b8d540f1bc\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 170128 5dcfcd517a7f5ce962038e66020facf3\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 175482 25868b065192977e98d6e99b515451a3\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 1430600 0bd5eaa495a9c94383f1f15560477891\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_amd64.deb\n Size/MD5 checksum: 1296334 4db706d5d837f7065e53ce6a59252155\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 4311026 b871957de2ee6acac4ebaa45fb2c5f10\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 137614 a35026505345301ffeb7d5e68fb75c42\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 211706 26c51ab1da0c47d1d435c7dd2a7796f8\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 1330996 7106d299f6e27555ccb0f12de7dfb70f\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 173464 699512df028745d69a5c12a193b30008\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_armel.deb\n Size/MD5 checksum: 1429912 8e2f973287c9131ed84c8f97971ed751\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 1549708 7a44aaffbc4591317894735f2573e086\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 1431268 38df677bd5d28514ce9b405ade7d5835\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 4814288 fba39ae5de217b78aebe796bc97c43fb\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 184682 3b32b5b832b02879913c697335b40457\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 253974 20901e88f1fecbae4b164df1ed84837d\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_hppa.deb\n Size/MD5 checksum: 183022 7b0793c628915bea83a5729f793e42ab\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 170000 9246afbdf5752af72e1ae72fb2cef44b\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 202288 c70896121f72ba54e6cde6fe39a880e9\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 4027048 3dac656cd42811ff7c57e39a37992f28\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 1428358 b6770fe23b426f787145f155ecc96cbf\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 174864 ef32b51ff99d7b2f2b1948710024349f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_i386.deb\n Size/MD5 checksum: 1195668 70bc31bb80ec24755d3ee398db3599d8\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 1894036 4faae563bd3fa34e3856b383da6ac521\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 209730 4af71cf9896c8c7bc3b916fbb9ea0f7f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 252278 ec6146ad2c770ba54fb73f4951e9b333\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 1425362 eb1d7956703ede87eac1da6feaef6f86\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 5128410 1a6ccd8968f4d9c1a81c354614bc2385\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_ia64.deb\n Size/MD5 checksum: 183230 26e3be3728f39c56c5187a38643fbf6c\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 1592960 32ab2973c03e09abadcc72e10e72ca37\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 155468 1c5df542ba5780ad2f4bc7d1aec08d8c\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 1423596 110ffbf34eb8d07b1a4a9d6f644d814f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 236598 f86dc42c9c9e1220d4fe35361722a5b0\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 157138 b1001d46968ccb19917c5448cd121958\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_mips.deb\n Size/MD5 checksum: 4177824 da3c1b4a9b0eb0479d23142a1e5aecca\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 1423542 c3fe8bf49f9471b84e44c41ed87c8763\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 4116618 68f90a47f4d038683d799625f1444338\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 151592 bee2279e2baa348142613cf249f5d8d4\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 1576970 b9d5ee5a59ec4fb016e3ca846ebbe105\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 154796 d91c3a37a413d97f0caa96cf2d706de6\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_mipsel.deb\n Size/MD5 checksum: 233142 7366c9f8ca5c9d60b3c6b923cef0cb8e\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 1461172 698ad0d3857875447f364dc497056e34\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 172188 c55a17ccba4739286a3d06e412a37c7e\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 1432568 46558be9be9d26fd5528c6a2ec7d50a3\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 225840 ebf6710bcf60ffd8c5f1721476df93cc\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 4555502 4d6dc45e0541aa4b33e1313b19a9dca6\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_powerpc.deb\n Size/MD5 checksum: 183318 570ca54165f4603b707b4b5c1a8291a9\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 4898598 7aab488bf8b2e26552a44e4eaa4b36ca\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 165968 b3baeeb34331fee9bf6ad7816a850b5f\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 1423042 5c18ab69a9a57c6ab91de017f1c11421\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 171208 c0c84e6f818e6fea609d313fafe9d02f\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 1249678 40bf0a5fc997df2032bfa14b52e49feb\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_s390.deb\n Size/MD5 checksum: 216898 9ab3e6b083115bebf395a10a1a31620a\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++10_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 169848 780d886a56b53d47c39ce8f9d33810d3\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick9-dev_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 1355378 9a8731c1d39fe9884d6ca583a8fb7e30\n http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 173572 fbf9df5c0d20728dd084c7c4404b8fc2\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++9-dev_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 204504 e6d21927050ba1bd4da56777544ccabc\n http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 1431724 e6512b716fa3e669e7c86e5879998438\n http://security.debian.org/pool/updates/main/i/imagemagick/libmagick10_6.3.7.9.dfsg2-1~lenny3_sparc.deb\n Size/MD5 checksum: 4187838 22f6eb7829ab478d045eda07bafa7bc9\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>\n", "modified": "2009-08-10T17:06:22", "published": "2009-08-10T17:06:22", "id": "DEBIAN:DSA-1858-1:1404B", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2009/msg00175.html", "title": "[SECURITY] [DSA 1858-1] New imagemagick packages fix several vulnerabilities", "type": "debian", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
