Hash: SHA512

Package        : graphicsmagick
Version        : 1.3.16-1.1+deb7u13
CVE ID         : CVE-2017-16352 CVE-2017-16353

Maor Shwartz, Jeremy Heng and Terry Chia discovered two security
vulnerabilities in Graphicsmagick, a collection of image processing tool
s.

CVE-2017-16352
   Graphicsmagick was vulnerable to a heap-based buffer
   overflow vulnerability found in the "Display visual image directory"
   feature of the DescribeImage() function of the magick/describe.c
   file. One possible  way to trigger the vulnerability is to run the
   identify command on a specially crafted MIFF format file with the
   verbose flag.

CVE-2017-16353
   Graphicsmagick was vulnerable to a memory information disclosure
   vulnerability found in the DescribeImage function of the
   magick/describe.c file, because of a heap-based buffer over-read. The
   portion of the code containing the vulnerability is responsible for
   printing the IPTC Profile information contained in the image. This
   vulnerability can be triggered with a specially crafted MIFF file.
   There is an out-of-bounds buffer dereference because certain
   increments are never checked.

For Debian 7 "Wheezy", these problems have been fixed in version
1.3.16-1.1+deb7u13.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS