ArchLinux: 201610-6: imagemagick: multiple issues
Summary
- CVE-2016-7799 (denial of service)
A buffer over-read vulnerability was found in ImageMagick. A malicious
file could cause the application to crash.
- CVE-2016-7906 (arbitrary code execution)
An attacker is able to trigger a use-after-free when providing a
crafted image to ImageMagick's mogrify function.
Resolution
Upgrade to 6.9.6.0-1.
# pacman -Syu "imagemagick>=6.9.6.0-1"
The problems have been fixed upstream in version 6.9.6.0.
References
https://github.com/ImageMagick/ImageMagick/commit/a7bb158b7bedd1449a34432feb3a67c8f1873bfa https://www.openwall.com/lists/oss-security/2016/10/01/6 https://github.com/ImageMagick/ImageMagick/issues/280 https://github.com/ImageMagick/ImageMagick/issues/281 https://www.openwall.com/lists/oss-security/2016/10/02/3 https://github.com/ImageMagick/ImageMagick/commit/d63a3c5729df59f183e9e110d5d8385d17caaad0 https://access.redhat.com/security/cve/CVE-2016-7799 https://access.redhat.com/security/cve/CVE-2016-7906
Workaround
None.