Lucene search

K
osvGoogleOSV:DLA-484-1
HistoryMay 21, 2016 - 12:00 a.m.

graphicsmagick - security update

2016-05-2100:00:00
Google
osv.dev
7

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

Several security vulnerabilities were discovered in graphicsmagick a
tool to manipulate image files.

GraphicsMagick is a fork of ImageMagick and also affected by
vulnerabilities collectively known as ImageTragick, that are the
consequence of lack of sanitization of untrusted input. An attacker
with control on the image input could, with the privileges of the user
running the application,
execute code
(CVE-2016-3714),
make HTTP GET or FTP requests
(CVE-2016-3718),
or delete
(CVE-2016-3715),
move
(CVE-2016-3716),
or read
(CVE-2016-3717),
local files.

To address these concerns the following changes have been made:

  1. Remove automatic detection/execution of MVG based on file header or
    file extension.
  2. Remove the ability to cause an input file to be deleted based on a
    filename specification.
  3. Improve the safety of delegates.mgk by removing gnuplot support,
    removing manual page support, and by adding -dSAFER to all
    ghostscript invocations.
  4. Sanity check the MVG image primitive filename argument to assure
    that “magick:” prefix strings will not be interpreted. Please note
    that this patch will break intentional uses of magick prefix
    strings in MVG and so some MVG scripts may fail. We will search
    for a more flexible solution.

In addition the following issues have been fixed:

  • CVE-2015-8808
    Assure that GIF decoder does not use unitialized data and cause an
    out-of-bound read.
  • CVE-2016-2317 and
    CVE-2016-2318
    Vulnerabilities that allow to read or write outside memory bounds
    (heap, stack) as well as some null-pointer derreferences to cause a
    denial of service when parsing SVG files.

For Debian 7 Wheezy, these problems have been fixed in version
1.3.16-1.1+deb7u1.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <https://wiki.debian.org/LTS&gt;

CPENameOperatorVersion
graphicsmagickeq1.3.16-1.1

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C