Gentoo Linux Security Advisory 201606-14 - Multiple vulnerabilities have been found in ImageMagick including overflows and possible Denials of Service. Versions less than 6.9.0.3 are affected.
70b73520d788fbcf5fd3bcbbb0cfc03ecd29886963a4711f6ca6c91671edb703
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201606-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: ImageMagick: Multiple vulnerabilities
Date: June 26, 2016
Bugs: #534106, #562892
ID: 201606-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in ImageMagick including
overflows and possible Denials of Service.
Background
==========
Imagemagick is a collection of tools and libraries for many image
formats.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-gfx/imagemagick < 6.9.0.3 >= 6.9.0.3
Description
===========
Multiple vulnerabilities have been discovered in ImageMagick including,
but not limited to, various overflows and potential Denials of Service.
Please visit the references and related bug reports for additional
information.
Impact
======
Remote attackers could potentially perform buffer overflows or conduct
Denials of Service.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All ImageMagick users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.0.3"
References
==========
[ 1 ] Double free in coders/pict.c:2000
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1448803
[ 2 ] Double free in coders/tga.c:221
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1490362
[ 3 ] Imagemagick fuzzing bug
http://www.openwall.com/lists/oss-security/2014/12/24/1
[ 4 ] Integer and Buffer overflow in coders/icon.c
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1459747
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201606-14
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5