Due to a large number of issues discovered in GhostScript that prevent it from being used by ImageMagick safely, this update includes a default policy change that disables support for the Postscript and PDF formats in ImageMagick. This policy can be overridden if necessary by using an alternate ImageMagick policy configuration.

It was discovered that several memory leaks existed when handling certain images in ImageMagick. An attacker could use this to cause a denial of service. (CVE-2018-14434, CVE-2018-14435, CVE-2018-14436, CVE-2018-14437, CVE-2018-16640, CVE-2018-16750)

It was discovered that ImageMagick did not properly initialize a variable before using it when processing MAT images. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14551)

It was discovered that an information disclosure vulnerability existed in ImageMagick when processing XBM images. An attacker could use this to expose sensitive information. (CVE-2018-16323)

It was discovered that an out-of-bounds write vulnerability existed in ImageMagick when handling certain images. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
(CVE-2018-16642)

It was discovered that ImageMagick did not properly check for errors in some situations. An attacker could use this to cause a denial of service. (CVE-2018-16643)

It was discovered that ImageMagick did not properly validate image meta data in some situations. An attacker could use this to cause a denial of service. (CVE-2018-16644)

It was discovered that ImageMagick did not prevent excessive memory allocation when handling certain image types. An attacker could use this to cause a denial of service. (CVE-2018-16645)

Sergej Schumilo and Cornelius Aschermann discovered that ImageMagick did not properly check for NULL in some situations when processing PNG images. An attacker could use this to cause a denial of service.
(CVE-2018-16749)

USN-3681-1 fixed vulnerabilities in Imagemagick. Unfortunately, the fix for CVE-2017-13144 introduced a regression in ImageMagick in Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This update reverts the fix for CVE-2017-13144 for those releases.

We apologize for the inconvenience.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities were fixed in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u9.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cineon parsing component in ImageMagick 7.0.8-26     Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a     Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a     check for insufficient image data in a     file.(CVE-2019-11470)

  - In ImageMagick before 7.0.8-8, a NULL pointer     dereference exists in the CheckEventLogging function in     MagickCore/log.c.(CVE-2018-16328)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50     0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of     several minutes during which CPU and memory resources     are consumed until ultimately an attempted large memory     allocation fails. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted file.(CVE-2018-15607)

  - The ReadMATImageV4 function in coders/mat.c in     ImageMagick 7.0.8-7 uses an uninitialized variable,     leading to memory corruption.(CVE-2018-14551)

  - There is a memory leak in the function WriteMSLImage of     coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in     GraphicsMagick before 1.3.31.(CVE-2018-18544)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ImageMagick: Uninitialized variable in coders/mat.c:ReadMATImageV4() allows for memory corruption     (CVE-2018-14551)

  - ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore     component and might lead to denial of service (CVE-2017-1000445)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage     in coders/png.c, related to length calculation and caused by an off-by-one error. (CVE-2017-17879)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage     in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check. (CVE-2017-17880)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allows attackers to cause a denial of service via a crafted MAT image file.
    (CVE-2017-17881)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in     coders/xpm.c, which allows attackers to cause a denial of service via a crafted XPM image file.
    (CVE-2017-17882)

  - In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in     coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file.
    (CVE-2017-17884)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in     coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.
    (CVE-2017-17885)

  - In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in     coders/psd.c, which allows attackers to cause a denial of service via a crafted psd image file.
    (CVE-2017-17886)

  - In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in     magick/cache.c, which allows attackers to cause a denial of service via a crafted MNG image file that is     processed by ReadOneMNGImage. (CVE-2017-17887)

  - In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c,     which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image     file. (CVE-2017-17914)

  - ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and     ProcessMSLScript, and associated with mishandling of MSLPushImage calls. (CVE-2017-17934)

  - In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c. (CVE-2017-18008)

  - In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.
    (CVE-2017-18022)

  - In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18027)

  - In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in     coders/tiff.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18028)

  - In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in     coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file.
    (CVE-2017-18029)

  - In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer     dereference vulnerability occurs because a memory allocation result is not checked, related to     GetOpenCLCacheDirectory. (CVE-2017-18209)

  - In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function     BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocation result is not checked.
    (CVE-2017-18210)

  - In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function     saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to     CacheOpenCLKernel. (CVE-2017-18211)

  - An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the     function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service     via a crafted file. (CVE-2017-18250)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the     function LoadOpenCLDevices in MagickCore/opencl.c, which allows attackers to cause a denial of service via     a crafted file. (CVE-2017-18253)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in     coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is     mishandled in an MngInfoDiscardObject call. (CVE-2017-18272)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in     coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage     in MagickCore/quantize.c) via a crafted SUN image file. (CVE-2018-11251)

  - In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use     after free via a crafted file. (CVE-2018-11624)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function     GetImagePixelCache in MagickCore/cache.c, which allows attackers to cause a denial of service via a     crafted CALS image file. (CVE-2018-11655)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an     XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process     that includes sensitive information, that information sometimes can be leaked via the image data.
    (CVE-2018-16323)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
    (CVE-2018-5246)

  - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. (CVE-2018-5247)

  - ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c. (CVE-2018-5357)

  - In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and     bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a     memory leak. This allows remote attackers to cause a denial of service. (CVE-2018-6405)

  - The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other     products, allows remote attackers to cause a denial of service (stack-based buffer under-read) via a     crafted bmp image. (CVE-2018-6876)

  - A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of     ImageMagick 7.0.7-22 allows a remote attacker to cause a denial of service (application crash) via a     maliciously crafted pict file. (CVE-2018-6930)

  - The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the     amount of image data in a file, which allows remote attackers to cause a denial of service (memory     allocation failure in the AcquireMagickMemory function in MagickCore/memory.c). (CVE-2018-7443)

  - An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c     allows attackers to cause a denial of service (segmentation violation) via a crafted file. (CVE-2018-7470)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory     allocation, leading to a heap-based buffer over-read. (CVE-2018-8960)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in     coders/webp.c. (CVE-2018-9135)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
117935	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ImageMagick vulnerabilities (USN-3785-1)	Nessus	Ubuntu Local Security Checks	10/5/2018	10/21/2023	critical
139675	Debian DLA-2333-1 : imagemagick security update	Nessus	Debian Local Security Checks	8/19/2020	2/23/2024	critical
132603	EulerOS 2.0 SP8 : ImageMagick (EulerOS-SA-2020-1010)	Nessus	Huawei Local Security Checks	1/2/2020	4/1/2024	critical
195375	RHEL 8 : imagemagick (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical