[SECURITY] [DLA 3200-1] graphicsmagick security update

2022-11-2023:34:59

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

23.3%

JSON

Debian LTS Advisory DLA-3200-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
November 21, 2022 https://wiki.debian.org/LTS

Package : graphicsmagick
Version : 1.4+really1.3.35-1~deb10u3
CVE ID : CVE-2022-1270

An issue has been found in graphicsmagick, a collection of image
processing tools.
Due to missing checks, a crafted MIFF file could result in a heap buffer
overflow when parsing it.

For Debian 10 buster, this problem has been fixed in version
1.4+really1.3.35-1~deb10u3.

We recommend that you upgrade your graphicsmagick packages.

For the detailed security status of graphicsmagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphicsmagick

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11armellibgraphicsmagick-q16-3< 1.4+really1.3.36+hg16481-2+deb11u1libgraphicsmagick-q16-3_1.4+really1.3.36+hg16481-2+deb11u1_armel.deb
Debian10allgraphicsmagick-libmagick-dev-compat< 1.4+really1.3.35-1~deb10u3graphicsmagick-libmagick-dev-compat_1.4+really1.3.35-1~deb10u3_all.deb
Debian11s390xlibgraphicsmagick++-q16-12< 1.4+really1.3.36+hg16481-2+deb11u1libgraphicsmagick++-q16-12_1.4+really1.3.36+hg16481-2+deb11u1_s390x.deb
Debian10i386libgraphicsmagick1-dev< 1.4+really1.3.35-1~deb10u3libgraphicsmagick1-dev_1.4+really1.3.35-1~deb10u3_i386.deb
Debian11armhfgraphicsmagick< 1.4+really1.3.36+hg16481-2+deb11u1graphicsmagick_1.4+really1.3.36+hg16481-2+deb11u1_armhf.deb
Debian11s390xlibgraphicsmagick++1-dev< 1.4+really1.3.36+hg16481-2+deb11u1libgraphicsmagick++1-dev_1.4+really1.3.36+hg16481-2+deb11u1_s390x.deb
Debian11amd64libgraphicsmagick1-dev< 1.4+really1.3.36+hg16481-2+deb11u1libgraphicsmagick1-dev_1.4+really1.3.36+hg16481-2+deb11u1_amd64.deb
Debian11armhflibgraphics-magick-perl< 1.4+really1.3.36+hg16481-2+deb11u1libgraphics-magick-perl_1.4+really1.3.36+hg16481-2+deb11u1_armhf.deb
Debian11allgraphicsmagick-imagemagick-compat< 1.4+really1.3.36+hg16481-2+deb11u1graphicsmagick-imagemagick-compat_1.4+really1.3.36+hg16481-2+deb11u1_all.deb
Debian10allgraphicsmagick< 1.4+really1.3.35-1~deb10u3graphicsmagick_1.4+really1.3.35-1~deb10u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	armel	libgraphicsmagick-q16-3	< 1.4+really1.3.36+hg16481-2+deb11u1	libgraphicsmagick-q16-3_1.4+really1.3.36+hg16481-2+deb11u1_armel.deb
Debian	10	all	graphicsmagick-libmagick-dev-compat	< 1.4+really1.3.35-1~deb10u3	graphicsmagick-libmagick-dev-compat_1.4+really1.3.35-1~deb10u3_all.deb
Debian	11	s390x	libgraphicsmagick++-q16-12	< 1.4+really1.3.36+hg16481-2+deb11u1	libgraphicsmagick++-q16-12_1.4+really1.3.36+hg16481-2+deb11u1_s390x.deb
Debian	10	i386	libgraphicsmagick1-dev	< 1.4+really1.3.35-1~deb10u3	libgraphicsmagick1-dev_1.4+really1.3.35-1~deb10u3_i386.deb
Debian	11	armhf	graphicsmagick	< 1.4+really1.3.36+hg16481-2+deb11u1	graphicsmagick_1.4+really1.3.36+hg16481-2+deb11u1_armhf.deb
Debian	11	s390x	libgraphicsmagick++1-dev	< 1.4+really1.3.36+hg16481-2+deb11u1	libgraphicsmagick++1-dev_1.4+really1.3.36+hg16481-2+deb11u1_s390x.deb
Debian	11	amd64	libgraphicsmagick1-dev	< 1.4+really1.3.36+hg16481-2+deb11u1	libgraphicsmagick1-dev_1.4+really1.3.36+hg16481-2+deb11u1_amd64.deb
Debian	11	armhf	libgraphics-magick-perl	< 1.4+really1.3.36+hg16481-2+deb11u1	libgraphics-magick-perl_1.4+really1.3.36+hg16481-2+deb11u1_armhf.deb
Debian	11	all	graphicsmagick-imagemagick-compat	< 1.4+really1.3.36+hg16481-2+deb11u1	graphicsmagick-imagemagick-compat_1.4+really1.3.36+hg16481-2+deb11u1_all.deb
Debian	10	all	graphicsmagick	< 1.4+really1.3.35-1~deb10u3	graphicsmagick_1.4+really1.3.35-1~deb10u3_all.deb