Debian LTS: DLA-2523-1: imagemagick security update
Summary
CVE-2017-14528
The TIFFSetProfiles function in coders/tiff.c has incorrect
expectations about whether LibTIFF TIFFGetField return values
imply that data validation has occurred, which allows remote
attackers to cause a denial of service (use-after-free after an
invalid call to TIFFSetField, and application crash) via a crafted
file.
CVE-2020-19667
Stack-based buffer overflow and unconditional jump in ReadXPMImage
in coders/xpm.c
CVE-2020-25665
The PALM image coder at coders/palm.c makes an improper call to
AcquireQuantumMemory() in routine WritePALMImage() because it
needs to be offset by 256. This can cause a out-of-bounds read
later on in the routine. This could cause impact to reliability.
CVE-2020-25674
WriteOnePNGImage() from coders/png.c (the PNG coder) has a for
loop with an improper exit condition that can allow an
out-of-bounds READ via heap-buffer-overflow. This occurs because
it is possible for the colormap to have less than 256 valid values
but the loop condition will loop 256 times, attempting to pass
invalid colormap data to the event logger.
CVE-2020-27560
ImageMagick allows Division by Zero in OptimizeLayerFrames in
MagickCore/layer.c, which may cause a denial of service.
CVE-2020-27750
A flaw was found in MagickCore/colorspace-private.h and
MagickCore/quantum.h. An attacker who submits a crafted file that
is processedcould trigger undefined behavior in the form of values
outside the range of type `unsigned char` and math division by
zero. This would most likely lead to an impact to application
availability, but could potentially cause other problems related
to undefined behavior.
CVE-2020-27760
In `GammaImage()` of /MagickCore/enhance.c, depending on the
`gamma` value, it's possible to trigger a divide-by-zero condition
when a crafted input file is processed by ImageMagick. This could
lead to an impact to application availability.
CVE-2020-27763
A flaw was found in MagickCore/resize.c. An attacker who submits a
crafted file that is processed by ImageMagick could trigger
undefined behavior in the form of math division by zero. This
would most likely lead to an impact to application availability,
but could potentially cause other problems related to undefined
behavior.
CVE-2020-27765
A flaw was found in MagickCore/segment.c. An attacker who submits
a crafted file that is processed by ImageMagick could trigger
undefined behavior in the form of math division by zero. This
would most likely lead to an impact to application availability,
but could potentially cause other problems related to undefined
behavior.
CVE-2020-27773
A flaw was found in MagickCore/gem-private.h. An attacker who
submits a crafted file that is processed by ImageMagick could
trigger undefined behavior in the form of values outside the range
of type `unsigned char` or division by zero. This would most
likely lead to an impact to application availability, but could
potentially cause other problems related to undefined behavior.
CVE-2020-29599
ImageMagick mishandles the -authenticate option, which allows
setting a password for password-protected PDF files. The
user-controlled password was not properly escaped/sanitized and it
was therefore possible to inject additional shell commands via
coders/pdf.c.
For Debian 9 stretch, these problems have been fixed in version
8:6.9.7.4+dfsg-11+deb9u11.
We recommend that you upgrade your imagemagick packages.
For the detailed security status of imagemagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/imagemagick
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
