Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.SUSE_SU-2023-4634-1.NASL
HistoryDec 02, 2023 - 12:00 a.m.

SUSE SLES15 Security Update : ImageMagick (SUSE-SU-2023:4634-1)

2023-12-0200:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
10
suse sles15
security update
imagemagick
vulnerabilities
heap-based buffer overflow
buffer overflow
divide-by-zero
integer overflow
cipher leak
denial of service
undefined behavior
data confidentiality

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.014 Low

EPSS

Percentile

86.5%

JSON

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4634-1 advisory.

  • ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  • Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format.
    (CVE-2020-21679)

  • A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20176)

  • An integer overflow issue was discovered in ImageMagick’s ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the ‘unsigned char’. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash. (CVE-2021-20224)

  • A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20241)

  • A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20243)

  • A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20244)

  • A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20246)

  • A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability. (CVE-2021-20309)

  • A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. (CVE-2021-20311)

  • A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. (CVE-2021-20312)

  • A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-20313)

  • A heap-based-buffer-over-read flaw was found in ImageMagick’s GetPixelAlpha() function of ‘pixel- accessor.h’. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure. (CVE-2022-0284)

  • In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)

  • ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)

  • A vulnerability was found in ImageMagick, causing an outside the range of representable values of type ‘unsigned char’ at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32545)

  • A vulnerability was found in ImageMagick, causing an outside the range of representable values of type ‘unsigned long’ at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32546)

  • In ImageMagick, there is load of misaligned address for type ‘double’, which requires 8 byte alignment and for type ‘float’, which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32547)

  • ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. (CVE-2022-44267)

  • ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). (CVE-2022-44268)

  • A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. (CVE-2023-1289)

  • A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  • A heap-based buffer overflow issue was found in ImageMagick’s PushCharPixel() function in quantum- private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service. (CVE-2023-3745)

  • A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2023:4634-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(186519);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/12/02");

  script_cve_id(
    "CVE-2019-17540",
    "CVE-2020-21679",
    "CVE-2021-20176",
    "CVE-2021-20224",
    "CVE-2021-20241",
    "CVE-2021-20243",
    "CVE-2021-20244",
    "CVE-2021-20246",
    "CVE-2021-20309",
    "CVE-2021-20311",
    "CVE-2021-20312",
    "CVE-2021-20313",
    "CVE-2022-0284",
    "CVE-2022-2719",
    "CVE-2022-28463",
    "CVE-2022-32545",
    "CVE-2022-32546",
    "CVE-2022-32547",
    "CVE-2022-44267",
    "CVE-2022-44268",
    "CVE-2023-1289",
    "CVE-2023-3745",
    "CVE-2023-5341",
    "CVE-2023-34151"
  );
  script_xref(name:"SuSE", value:"SUSE-SU-2023:4634-1");

  script_name(english:"SUSE SLES15 Security Update : ImageMagick (SUSE-SU-2023:4634-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as
referenced in the SUSE-SU-2023:4634-1 advisory.

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote
    attackers to cause a denial of service via converting of crafted image file to pcx format.
    (CVE-2020-21679)

  - A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an
    attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through
    a division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20176)

  - An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in
    MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of
    representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to
    an undefined behaviour or a crash. (CVE-2021-20224)

  - A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed
    by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat
    from this vulnerability is to system availability. (CVE-2021-20241)

  - A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is
    processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The
    highest threat from this vulnerability is to system availability. (CVE-2021-20243)

  - A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file
    that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20244)

  - A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is
    processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The
    highest threat from this vulnerability is to system availability. (CVE-2021-20246)

  - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in
    WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file
    submitted to an application using ImageMagick. The highest threat from this vulnerability is to system
    availability. (CVE-2021-20309)

  - A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in
    sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image
    file that is submitted by an attacker processed by an application using ImageMagick. The highest threat
    from this vulnerability is to system availability. (CVE-2021-20311)

  - A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of
    coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an
    attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is
    to system availability. (CVE-2021-20312)

  - A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate
    signatures in TransformSignature is possible. The highest threat from this vulnerability is to data
    confidentiality. (CVE-2021-20313)

  - A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-
    accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File
    Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of
    service and information disclosure. (CVE-2022-0284)

  - In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in
    MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This
    was fixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)

  - ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type
    'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative
    impact to application availability or other problems related to undefined behavior. (CVE-2022-32545)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type
    'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative
    impact to application availability or other problems related to undefined behavior. (CVE-2022-32546)

  - In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and
    for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted
    input is processed by ImageMagick, this causes a negative impact to application availability or other
    problems related to undefined behavior. (CVE-2022-32547)

  - ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize),
    the convert process could be left waiting for stdin input. (CVE-2022-44267)

  - ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for
    resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary
    has permissions to read it). (CVE-2022-44268)

  - A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a
    segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to
    a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When
    ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file
    contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of
    size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will
    generate about 10G. (CVE-2023-1289)

  - A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting
    double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-
    private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,
    triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of
    service. (CVE-2023-3745)

  - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1153866");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1181836");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1182325");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1182335");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1182336");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1182337");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1184624");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1184626");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1184627");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1184628");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1195563");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1197147");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1199350");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200387");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200388");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200389");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1202250");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1202800");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207982");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1207983");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1209141");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1211791");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1213624");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1214578");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1215939");
  script_set_attribute(attribute:"see_also", value:"https://lists.suse.com/pipermail/sle-updates/2023-December/032996.html");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-17540");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-21679");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20176");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20224");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20241");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20243");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20244");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20246");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20309");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20311");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20312");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20313");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-0284");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-2719");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-28463");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-32545");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-32546");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-32547");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-44267");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-44268");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-1289");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-34151");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-3745");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-5341");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-32547");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2019-17540");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/12/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-7-SUSE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-7-upstream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-7_Q16HDRI4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-7_Q16HDRI6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-7_Q16HDRI6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:perl-PerlMagick");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)(?:_SAP)?\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15|SLES_SAP15)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);

var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(1)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES15 SP1", os_ver + " SP" + service_pack);
if (os_ver == "SLES_SAP15" && (! preg(pattern:"^(1)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES_SAP15 SP1", os_ver + " SP" + service_pack);

var pkgs = [
    {'reference':'ImageMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'ImageMagick-config-7-SUSE-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'ImageMagick-config-7-upstream-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'ImageMagick-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'libMagick++-7_Q16HDRI4-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'libMagick++-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'libMagickCore-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'libMagickWand-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'perl-PerlMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.1']},
    {'reference':'ImageMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-config-7-SUSE-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-config-7-SUSE-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-config-7-upstream-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-config-7-upstream-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagick++-7_Q16HDRI4-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagick++-7_Q16HDRI4-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagick++-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagick++-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagickCore-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagickCore-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagickWand-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'libMagickWand-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'perl-PerlMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'perl-PerlMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1']},
    {'reference':'ImageMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'ImageMagick-config-7-SUSE-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'ImageMagick-config-7-upstream-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'ImageMagick-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'libMagick++-7_Q16HDRI4-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'libMagick++-devel-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'libMagickCore-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'libMagickWand-7_Q16HDRI6-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']},
    {'reference':'perl-PerlMagick-7.0.7.34-150000.3.123.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.1']}
];

var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var exists_check = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (exists_check) {
      var check_flag = 0;
      foreach var check (exists_check) {
        if (!rpm_exists(release:_release, rpm:check)) continue;
        if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;
        check_flag++;
      }
      if (!check_flag) continue;
    }
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  var ltss_plugin_caveat = NULL;
  if(ltss_caveat_required) ltss_plugin_caveat = '\n' +
    'NOTE: This vulnerability check contains fixes that apply to\n' +
    'packages only available in SUSE Enterprise Linux Server LTSS\n' +
    'repositories. Access to these package security updates require\n' +
    'a paid SUSE LTSS subscription.\n';
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + ltss_plugin_caveat
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ImageMagick / ImageMagick-config-7-SUSE / etc');
}
VendorProductVersionCPE
novellsuse_linuximagemagickp-cpe:/a:novell:suse_linux:imagemagick
novellsuse_linuximagemagick-config-7-susep-cpe:/a:novell:suse_linux:imagemagick-config-7-suse
novellsuse_linuximagemagick-config-7-upstreamp-cpe:/a:novell:suse_linux:imagemagick-config-7-upstream
novellsuse_linuximagemagick-develp-cpe:/a:novell:suse_linux:imagemagick-devel
novellsuse_linuxlibmagick%2b%2b-7_q16hdri4p-cpe:/a:novell:suse_linux:libmagick%2b%2b-7_q16hdri4
novellsuse_linuxlibmagick%2b%2b-develp-cpe:/a:novell:suse_linux:libmagick%2b%2b-devel
novellsuse_linuxlibmagickcore-7_q16hdri6p-cpe:/a:novell:suse_linux:libmagickcore-7_q16hdri6
novellsuse_linuxlibmagickwand-7_q16hdri6p-cpe:/a:novell:suse_linux:libmagickwand-7_q16hdri6
novellsuse_linuxperl-perlmagickp-cpe:/a:novell:suse_linux:perl-perlmagick
novellsuse_linux15cpe:/o:novell:suse_linux:15

References

Related

openvas 44
nessus 53
osv 18
debian 5
ubuntu 8
cloudfoundry 4
suse 6
mageia 2
amazon 4
freebsd 2
gentoo 1
cvelist 2
thn 1
ubuntucve 4
fedora 2
alpinelinux 5
prion 3
debiancve 6
nvd 4
redos 2
wallarmlab 1
cve 5
photon 8
redhatcve 5
veracode 3
zdt 1
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2023:4634-1)
2023-12-04 00:00:00
Debian: Security Advisory (DLA-3429-1)
2023-05-22 00:00:00
Ubuntu: Security Advisory (USN-5158-1)
2021-11-30 00:00:00
nessus
nessus
Debian DLA-3429-1 : imagemagick - LTS security update
2023-05-22 00:00:00
Ubuntu 16.04 ESM / 18.04 LTS : ImageMagick vulnerabilities (USN-5158-1)
2021-11-30 00:00:00
Ubuntu 16.04 ESM / 18.04 LTS : ImageMagick vulnerabilities (USN-5736-1)
2022-11-24 00:00:00
osv
osv
imagemagick - security update
2023-05-21 00:00:00
imagemagick vulnerabilities
2021-11-29 23:50:45
imagemagick vulnerabilities
2022-11-24 11:23:13
debian
debian
[SECURITY] [DLA 3429-1] imagemagick security update
2023-05-21 22:21:31
[SECURITY] [DLA 2672-1] imagemagick security update
2021-06-03 04:59:38
[SECURITY] [DLA 3737-1] imagemagick security update
2024-02-22 09:45:50
ubuntu
ubuntu
ImageMagick vulnerabilities
2021-11-29 00:00:00
ImageMagick vulnerabilities
2022-11-24 00:00:00
ImageMagick vulnerabilities
2022-11-24 00:00:00
cloudfoundry
cloudfoundry
USN-5158-1: ImageMagick vulnerabilities | Cloud Foundry
2022-01-20 00:00:00
USN-5736-1: ImageMagick vulnerabilities | Cloud Foundry
2023-02-03 00:00:00
USN-5855-2: ImageMagick vulnerabilities | Cloud Foundry
2023-03-23 00:00:00
suse
suse
Security update for ImageMagick (moderate)
2021-03-03 00:00:00
Security update for ImageMagick (moderate)
2021-04-23 00:00:00
Security update for ImageMagick (moderate)
2022-07-04 00:00:00
mageia
mageia
Updated imagemagick packages fix security vulnerabilities
2021-03-27 17:27:02
Updated imagemagick packages fix security vulnerability
2022-12-07 02:32:48
amazon
amazon
Medium: ImageMagick
2023-03-02 20:22:00
Medium: ImageMagick
2023-03-02 22:35:00
Medium: ImageMagick
2023-02-17 00:12:00
freebsd
freebsd
ImageMagick7 -- multiple vulnerabilities
2020-10-27 00:00:00
ImageMagick6 -- multiple vulnerabilities
2020-12-17 00:00:00
gentoo
gentoo
ImageMagick: Multiple Vulnerabilities
2024-05-04 00:00:00
cvelist
cvelist
CVE-2023-34151
2023-05-30 00:00:00
CVE-2020-21679
2023-08-22 00:00:00
thn
thn
Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility
2023-02-01 19:59:00
ubuntucve
ubuntucve
CVE-2021-20243
2021-03-09 00:00:00
CVE-2021-20313
2021-05-11 00:00:00
CVE-2023-34151
2023-05-30 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: ImageMagick-6.9.12.77-1.fc36
2023-02-22 11:10:31
[SECURITY] Fedora 37 Update: ImageMagick-6.9.12.77-1.fc37
2023-02-17 18:22:02
alpinelinux
alpinelinux
CVE-2023-34151
2023-05-30 22:15:00
CVE-2021-20241
2021-03-09 18:15:14
CVE-2021-20312
2021-05-11 23:15:08
prion
prion
Design/Logic Flaw
2023-05-30 22:15:00
Heap overflow
2019-10-14 02:15:00
Integer overflow
2021-05-11 23:15:00
debiancve
debiancve
CVE-2023-34151
2023-05-30 22:15:11
CVE-2021-20241
2021-03-09 18:15:14
CVE-2019-17540
2019-10-14 02:15:10
nvd
nvd
CVE-2023-34151
2023-05-30 22:15:11
CVE-2021-20311
2021-05-11 23:15:08
CVE-2021-20244
2021-03-09 19:15:12
redos
redos
ROS-20221121-03
2022-11-21 00:00:00
ROS-20230213-01
2023-02-13 00:00:00
wallarmlab
wallarmlab
Yet More ImageMagick Vulnerabilities
2023-02-06 09:49:07
cve
cve
CVE-2023-34151
2023-05-30 22:15:11
CVE-2022-44267
2023-02-06 21:15:09
CVE-2020-21679
2023-08-22 19:16:13
photon
photon
Critical Photon OS Security Update - PHSA-2023-5.0-0021
2023-06-07 00:00:00
Critical Photon OS Security Update - PHSA-2022-0418
2022-07-11 00:00:00
Moderate Photon OS Security Update - PHSA-2023-4.0-0345
2023-03-03 00:00:00
redhatcve
redhatcve
CVE-2021-20311
2021-04-06 18:48:44
CVE-2021-20241
2021-02-15 21:58:51
CVE-2021-20243
2021-02-15 21:58:52
veracode
veracode
Denial Of Service (DoS)
2021-03-25 00:58:58
Denial Of Service (DoS)
2022-06-17 02:44:36
Denial Of Service (DoS)
2023-02-10 17:50:08
zdt
zdt
ImageMagick 7.1.0-49 - Denial Of Service Vulnerability
2023-04-05 00:00:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.014 Low

EPSS

Percentile

86.5%

JSON
Related for SUSE_SU-2023-4634-1.NASL
openvas44nessus53osv18debian5ubuntu8cloudfoundry4suse6mageia2amazon4freebsd2gentoo1cvelist2thn1ubuntucve4fedora2alpinelinux5prion3debiancve6nvd4redos2wallarmlab1cve5photon8redhatcve5veracode3zdt1