- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2523-1                [email protected]
https://www.debian.org/lts/security/                                     
January 12, 2021                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : imagemagick
Version        : 8:6.9.7.4+dfsg-11+deb9u11
CVE ID         : CVE-2017-14528 CVE-2020-19667 CVE-2020-25665 CVE-2020-25674 
                 CVE-2020-27560 CVE-2020-27750 CVE-2020-27760 CVE-2020-27763 
                 CVE-2020-27765 CVE-2020-27773 CVE-2020-29599
Debian Bug     : 878544 972797 977205

Several security vulnerabilities were found in ImageMagick, a suite of
image manipulation programs. An attacker could cause denial of service
and execution of arbitrary code when a crafted image file is
processed.

CVE-2017-14528

    The TIFFSetProfiles function in coders/tiff.c has incorrect
    expectations about whether LibTIFF TIFFGetField return values
    imply that data validation has occurred, which allows remote
    attackers to cause a denial of service (use-after-free after an
    invalid call to TIFFSetField, and application crash) via a crafted
    file.

CVE-2020-19667

    Stack-based buffer overflow and unconditional jump in ReadXPMImage
    in coders/xpm.c

CVE-2020-25665

    The PALM image coder at coders/palm.c makes an improper call to
    AcquireQuantumMemory() in routine WritePALMImage() because it
    needs to be offset by 256. This can cause a out-of-bounds read
    later on in the routine. This could cause impact to reliability.

CVE-2020-25674

    WriteOnePNGImage() from coders/png.c (the PNG coder) has a for
    loop with an improper exit condition that can allow an
    out-of-bounds READ via heap-buffer-overflow. This occurs because
    it is possible for the colormap to have less than 256 valid values
    but the loop condition will loop 256 times, attempting to pass
    invalid colormap data to the event logger.

CVE-2020-27560

    ImageMagick allows Division by Zero in OptimizeLayerFrames in
    MagickCore/layer.c, which may cause a denial of service.

CVE-2020-27750

    A flaw was found in MagickCore/colorspace-private.h and
    MagickCore/quantum.h. An attacker who submits a crafted file that
    is processedcould trigger undefined behavior in the form of values
    outside the range of type `unsigned char` and math division by
    zero. This would most likely lead to an impact to application
    availability, but could potentially cause other problems related
    to undefined behavior.

CVE-2020-27760

    In `GammaImage()` of /MagickCore/enhance.c, depending on the
    `gamma` value, it's possible to trigger a divide-by-zero condition
    when a crafted input file is processed by ImageMagick. This could
    lead to an impact to application availability.

CVE-2020-27763

    A flaw was found in MagickCore/resize.c. An attacker who submits a
    crafted file that is processed by ImageMagick could trigger
    undefined behavior in the form of math division by zero. This
    would most likely lead to an impact to application availability,
    but could potentially cause other problems related to undefined
    behavior.

CVE-2020-27765

    A flaw was found in MagickCore/segment.c. An attacker who submits
    a crafted file that is processed by ImageMagick could trigger
    undefined behavior in the form of math division by zero. This
    would most likely lead to an impact to application availability,
    but could potentially cause other problems related to undefined
    behavior.

CVE-2020-27773

    A flaw was found in MagickCore/gem-private.h. An attacker who
    submits a crafted file that is processed by ImageMagick could
    trigger undefined behavior in the form of values outside the range
    of type `unsigned char` or division by zero. This would most
    likely lead to an impact to application availability, but could
    potentially cause other problems related to undefined behavior.

CVE-2020-29599

    ImageMagick mishandles the -authenticate option, which allows
    setting a password for password-protected PDF files. The
    user-controlled password was not properly escaped/sanitized and it
    was therefore possible to inject additional shell commands via
    coders/pdf.c.

For Debian 9 stretch, these problems have been fixed in version
8:6.9.7.4+dfsg-11+deb9u11.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS