ESB-2017.3251 - [Linux][SUSE] ImageMagick: Multiple vulnerabilities 2017-12-21

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.3251
                     ImageMagick patched in SUSE Linux
                             21 December 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           ImageMagick
Publisher:         SUSE
Operating System:  SUSE
                   Linux variants
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote/Unauthenticated      
                   Access Confidential Data        -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-16546 CVE-2017-16545 CVE-2017-15930
                   CVE-2017-14733 CVE-2017-14607 CVE-2017-14531
                   CVE-2017-14342 CVE-2017-14341 CVE-2017-14175
                   CVE-2017-14173 CVE-2017-14172 CVE-2017-13769
                   CVE-2017-13134 CVE-2017-12983 CVE-2017-12669
                   CVE-2017-12662 CVE-2017-12644 CVE-2017-12587
                   CVE-2017-12435 CVE-2017-12140 CVE-2017-11752
                   CVE-2017-11640 CVE-2017-11535 CVE-2017-11527
                   CVE-2017-11478 CVE-2017-11188 

Reference:         ESB-2017.1821.2

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2017/suse-su-20173378-1/
   https://www.suse.com/support/update/announcement/2017/suse-su-20173388-1/

Comment: This bulletin contains two (2) SUSE security advisories.
         
         This advisory references vulnerabilities in products which run on 
         platforms other than SUSE. It is recommended that administrators 
         running ImageMagick check for an updated version of the software for
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for ImageMagick
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:3378-1
Rating:             important
References:         #1048457 #1049796 #1050116 #1050139 #1050632 
                    #1051441 #1051847 #1052450 #1052553 #1052689 
                    #1052758 #1052764 #1054757 #1055214 #1056432 
                    #1057719 #1057729 #1057730 #1058485 #1058637 
                    #1059666 #1059778 #1060577 #1066003 #1067181 
                    #1067184 
Cross-References:   CVE-2017-11188 CVE-2017-11478 CVE-2017-11527
                    CVE-2017-11535 CVE-2017-11640 CVE-2017-11752
                    CVE-2017-12140 CVE-2017-12435 CVE-2017-12587
                    CVE-2017-12644 CVE-2017-12662 CVE-2017-12669
                    CVE-2017-12983 CVE-2017-13134 CVE-2017-13769
                    CVE-2017-14172 CVE-2017-14173 CVE-2017-14175
                    CVE-2017-14341 CVE-2017-14342 CVE-2017-14531
                    CVE-2017-14607 CVE-2017-14733 CVE-2017-15930
                    CVE-2017-16545 CVE-2017-16546
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that fixes 26 vulnerabilities is now available.

Description:

   This update for ImageMagick fixes the following issues:

     * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas
       could possibly disclose potentially sensitive memory [bsc#1059778]

     * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in
       coders/tiff.c [bsc#1050632]

     * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in
       coders/wpg.c could lead to denial of service [bsc#1058485]

     * CVE-2017-14341: Infinite loop in the ReadWPGImage function
       [bsc#1058637]

     * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c
       could lead to denial of service [bsc#1067181]

     * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in
       validation problems could lead to denial of service [bsc#1067184]

     * CVE-2017-14175: Lack of End of File check could lead to denial of
       service [bsc#1057719]

     * CVE-2017-13769: denial of service issue in function
       WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432]

     * CVE-2017-13134: a heap-based buffer over-read was found in thefunction
       SFWScan in coders/sfw.c, which allows attackers to cause adenial of
       service via a crafted file. [bsc#1055214]

     * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick
       allows remote attackers to cause a DoS [bsc#1049796]

     * CVE-2017-15930: Null Pointer dereference  while transfering JPEG
       scanlines could lead to denial of service [bsc#1066003]

     * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage
       function in coders/sfw.c allows remote attackers to cause a denial of
       service [bsc#1054757]

     * CVE-2017-14531: memory exhaustion issue in ReadSUNImage
       incoders/sun.c. [bsc#1059666]

     * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c,
       which allows attackers to cause denial of service [bsc#1052553]

     * CVE-2017-12587: User controlable large loop in the ReadPWPImage in
       coders\pwp.c could lead to denial of service [bsc#1052450]

     * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer
       overflow that could lead to denial of service [bsc#1057729]

     * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c
       in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause
       CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check.
       [bnc#1048457]

     * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows
       remote attackers to cause DoS [bnc#1050116]

     * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer
       over-read in WritePSImage() in coders/ps.c [bnc#1050139]

     * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows
       to cause DoS  [bnc#1051441]

     * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a
       ninteger signedness error leading to excessive memory consumption
       [bnc#1051847]

     * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in
       coders/cals.c [bnc#1052689]

     * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in
       WritePDFImage in coders/pdf.c [bnc#1052758]

     * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in
       codersdcm.c [bnc#1052764]

     * CVE-2017-14172: ImageMagick: Lack of end of file check in
       ReadPSImage() could lead to a denial of service [bnc#1057730]

     * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in
       coders/rle.c could lead to denial of service [bnc#1060577]


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-ImageMagick-13384=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-ImageMagick-13384=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-ImageMagick-13384=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      ImageMagick-6.4.3.6-7.78.14.1
      ImageMagick-devel-6.4.3.6-7.78.14.1
      libMagick++-devel-6.4.3.6-7.78.14.1
      libMagick++1-6.4.3.6-7.78.14.1
      libMagickWand1-6.4.3.6-7.78.14.1
      perl-PerlMagick-6.4.3.6-7.78.14.1

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64):

      libMagickWand1-32bit-6.4.3.6-7.78.14.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      libMagickCore1-6.4.3.6-7.78.14.1

   - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):

      libMagickCore1-32bit-6.4.3.6-7.78.14.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      ImageMagick-debuginfo-6.4.3.6-7.78.14.1
      ImageMagick-debugsource-6.4.3.6-7.78.14.1


References:

   https://www.suse.com/security/cve/CVE-2017-11188.html
   https://www.suse.com/security/cve/CVE-2017-11478.html
   https://www.suse.com/security/cve/CVE-2017-11527.html
   https://www.suse.com/security/cve/CVE-2017-11535.html
   https://www.suse.com/security/cve/CVE-2017-11640.html
   https://www.suse.com/security/cve/CVE-2017-11752.html
   https://www.suse.com/security/cve/CVE-2017-12140.html
   https://www.suse.com/security/cve/CVE-2017-12435.html
   https://www.suse.com/security/cve/CVE-2017-12587.html
   https://www.suse.com/security/cve/CVE-2017-12644.html
   https://www.suse.com/security/cve/CVE-2017-12662.html
   https://www.suse.com/security/cve/CVE-2017-12669.html
   https://www.suse.com/security/cve/CVE-2017-12983.html
   https://www.suse.com/security/cve/CVE-2017-13134.html
   https://www.suse.com/security/cve/CVE-2017-13769.html
   https://www.suse.com/security/cve/CVE-2017-14172.html
   https://www.suse.com/security/cve/CVE-2017-14173.html
   https://www.suse.com/security/cve/CVE-2017-14175.html
   https://www.suse.com/security/cve/CVE-2017-14341.html
   https://www.suse.com/security/cve/CVE-2017-14342.html
   https://www.suse.com/security/cve/CVE-2017-14531.html
   https://www.suse.com/security/cve/CVE-2017-14607.html
   https://www.suse.com/security/cve/CVE-2017-14733.html
   https://www.suse.com/security/cve/CVE-2017-15930.html
   https://www.suse.com/security/cve/CVE-2017-16545.html
   https://www.suse.com/security/cve/CVE-2017-16546.html
   https://bugzilla.suse.com/1048457
   https://bugzilla.suse.com/1049796
   https://bugzilla.suse.com/1050116
   https://bugzilla.suse.com/1050139
   https://bugzilla.suse.com/1050632
   https://bugzilla.suse.com/1051441
   https://bugzilla.suse.com/1051847
   https://bugzilla.suse.com/1052450
   https://bugzilla.suse.com/1052553
   https://bugzilla.suse.com/1052689
   https://bugzilla.suse.com/1052758
   https://bugzilla.suse.com/1052764
   https://bugzilla.suse.com/1054757
   https://bugzilla.suse.com/1055214
   https://bugzilla.suse.com/1056432
   https://bugzilla.suse.com/1057719
   https://bugzilla.suse.com/1057729
   https://bugzilla.suse.com/1057730
   https://bugzilla.suse.com/1058485
   https://bugzilla.suse.com/1058637
   https://bugzilla.suse.com/1059666
   https://bugzilla.suse.com/1059778
   https://bugzilla.suse.com/1060577
   https://bugzilla.suse.com/1066003
   https://bugzilla.suse.com/1067181
   https://bugzilla.suse.com/1067184

- --------------------------------------------------------------------------------

   SUSE Security Update: Security update for ImageMagick
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:3388-1
Rating:             important
References:         #1048457 #1049796 #1050083 #1050116 #1050139 
                    #1050632 #1051441 #1051847 #1052450 #1052553 
                    #1052689 #1052744 #1052758 #1052764 #1054757 
                    #1055214 #1056432 #1057157 #1057719 #1057729 
                    #1057730 #1058485 #1058637 #1059666 #1059778 
                    #1060176 #1060577 #1061254 #1062750 #1066003 
                    #1067181 #1067184 #1067409 
Cross-References:   CVE-2017-11188 CVE-2017-11478 CVE-2017-11523
                    CVE-2017-11527 CVE-2017-11535 CVE-2017-11640
                    CVE-2017-11752 CVE-2017-12140 CVE-2017-12435
                    CVE-2017-12587 CVE-2017-12644 CVE-2017-12662
                    CVE-2017-12669 CVE-2017-12983 CVE-2017-13134
                    CVE-2017-13769 CVE-2017-14138 CVE-2017-14172
                    CVE-2017-14173 CVE-2017-14175 CVE-2017-14341
                    CVE-2017-14342 CVE-2017-14531 CVE-2017-14607
                    CVE-2017-14682 CVE-2017-14733 CVE-2017-14989
                    CVE-2017-15217 CVE-2017-15930 CVE-2017-16545
                    CVE-2017-16546 CVE-2017-16669
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 12-SP3
                    SUSE Linux Enterprise Workstation Extension 12-SP2
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Software Development Kit 12-SP2
                    SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Server 12-SP2
                    SUSE Linux Enterprise Desktop 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________

   An update that solves 32 vulnerabilities and has one errata
   is now available.

Description:

   This update for ImageMagick fixes the following issues:

     * CVE-2017-14989: use-after-free in RenderFreetype in
       MagickCore/annotate.c could lead to denial of service [bsc#1061254]
     * CVE-2017-14682: GetNextToken in MagickCore/token.c heap buffer
       overflow could lead to denial of service [bsc#1060176]
     * Memory leak in WriteINLINEImage in coders/inline.c could lead to
       denial of service [bsc#1052744]
     * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas
       could possibly disclose potentially sensitive memory [bsc#1059778]
     * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in
       coders/tiff.c [bsc#1050632]
     * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in
       coders/wpg.c could lead to denial of service [bsc#1058485]
     * CVE-2017-14341: Infinite loop in the ReadWPGImage function
       [bsc#1058637]
     * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c
       could lead to denial of service [bsc#1067181]
     * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in
       validation problems could lead to denial of service [bsc#1067184]
     * CVE-2017-16669: problem in coders/wpg.c could allow remote attackers
       to cause a denial of service via crafted file [bsc#1067409]
     * CVE-2017-14175: Lack of End of File check could lead to denial of
       service [bsc#1057719]
     * CVE-2017-14138: memory leak vulnerability in ReadWEBPImage in
       coders/webp.c could lead to denial of service [bsc#1057157]
     * CVE-2017-13769: denial of service issue in function
       WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432]
     * CVE-2017-13134: a heap-based buffer over-read was found in thefunction
       SFWScan in coders/sfw.c, which allows attackers to cause adenial of
       service via a crafted file. [bsc#1055214]
     * CVE-2017-15217: memory leak in ReadSGIImage in coders/sgi.c
       [bsc#1062750]
     * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick
       allows remote attackers to cause a DoS [bsc#1049796]
     * CVE-2017-15930: Null Pointer dereference  while transfering JPEG
       scanlines could lead to denial of service [bsc#1066003]
     * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage
       function in coders/sfw.c inImageMagick 7.0.6-8 allows remote attackers
       to cause a denial of service [bsc#1054757]
     * CVE-2017-14531: memory exhaustion issue in ReadSUNImage
       incoders/sun.c. [bsc#1059666]
     * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c,
       which allows attackers to cause denial of service [bsc#1052553]
     * CVE-2017-12587: User controlable large loop in the ReadPWPImage in
       coders\pwp.c could lead to denial of service [bsc#1052450]
     * CVE-2017-11523: ReadTXTImage in coders/txt.c allows remote attackers
       to cause a denial of service [bsc#1050083]
     * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer
       overflow that could lead to denial of service [bsc#1057729]
     * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c
       in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause
       CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check.
       [bnc#1048457]
     * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows
       remote attackers to cause DoS [bnc#1050116]
     * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer
       over-read in WritePSImage() in coders/ps.c [bnc#1050139]
     * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows
       to cause DoS  [bnc#1051441]
     * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a
       ninteger signedness error leading to excessive memory consumption
       [bnc#1051847]
     * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in
       coders/cals.c [bnc#1052689]
     * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in
       WritePDFImage in coders/pdf.c [bnc#1052758]
     * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in
       codersdcm.c [bnc#1052764]
     * CVE-2017-14172: ImageMagick: Lack of end of file check in
       ReadPSImage() could lead to a denial of service [bnc#1057730]
     * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in
       coders/rle.c could lead to denial of service [bnc#1060577]


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 12-SP3:

      zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2123=1

   - SUSE Linux Enterprise Workstation Extension 12-SP2:

      zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2123=1

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2123=1

   - SUSE Linux Enterprise Software Development Kit 12-SP2:

      zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2123=1

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:

      zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2123=1

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2123=1

   - SUSE Linux Enterprise Server 12-SP2:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2123=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2123=1

   - SUSE Linux Enterprise Desktop 12-SP2:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2123=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      ImageMagick-devel-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagick++-devel-6.8.8.1-71.17.1
      perl-PerlMagick-6.8.8.1-71.17.1
      perl-PerlMagick-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      ImageMagick-devel-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagick++-devel-6.8.8.1-71.17.1
      perl-PerlMagick-6.8.8.1-71.17.1
      perl-PerlMagick-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):

      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64):

      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1

   - SUSE Linux Enterprise Desktop 12-SP2 (x86_64):

      ImageMagick-6.8.8.1-71.17.1
      ImageMagick-debuginfo-6.8.8.1-71.17.1
      ImageMagick-debugsource-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-6.8.8.1-71.17.1
      libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1
      libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-6.8.8.1-71.17.1
      libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1


References:

   https://www.suse.com/security/cve/CVE-2017-11188.html
   https://www.suse.com/security/cve/CVE-2017-11478.html
   https://www.suse.com/security/cve/CVE-2017-11523.html
   https://www.suse.com/security/cve/CVE-2017-11527.html
   https://www.suse.com/security/cve/CVE-2017-11535.html
   https://www.suse.com/security/cve/CVE-2017-11640.html
   https://www.suse.com/security/cve/CVE-2017-11752.html
   https://www.suse.com/security/cve/CVE-2017-12140.html
   https://www.suse.com/security/cve/CVE-2017-12435.html
   https://www.suse.com/security/cve/CVE-2017-12587.html
   https://www.suse.com/security/cve/CVE-2017-12644.html
   https://www.suse.com/security/cve/CVE-2017-12662.html
   https://www.suse.com/security/cve/CVE-2017-12669.html
   https://www.suse.com/security/cve/CVE-2017-12983.html
   https://www.suse.com/security/cve/CVE-2017-13134.html
   https://www.suse.com/security/cve/CVE-2017-13769.html
   https://www.suse.com/security/cve/CVE-2017-14138.html
   https://www.suse.com/security/cve/CVE-2017-14172.html
   https://www.suse.com/security/cve/CVE-2017-14173.html
   https://www.suse.com/security/cve/CVE-2017-14175.html
   https://www.suse.com/security/cve/CVE-2017-14341.html
   https://www.suse.com/security/cve/CVE-2017-14342.html
   https://www.suse.com/security/cve/CVE-2017-14531.html
   https://www.suse.com/security/cve/CVE-2017-14607.html
   https://www.suse.com/security/cve/CVE-2017-14682.html
   https://www.suse.com/security/cve/CVE-2017-14733.html
   https://www.suse.com/security/cve/CVE-2017-14989.html
   https://www.suse.com/security/cve/CVE-2017-15217.html
   https://www.suse.com/security/cve/CVE-2017-15930.html
   https://www.suse.com/security/cve/CVE-2017-16545.html
   https://www.suse.com/security/cve/CVE-2017-16546.html
   https://www.suse.com/security/cve/CVE-2017-16669.html
   https://bugzilla.suse.com/1048457
   https://bugzilla.suse.com/1049796
   https://bugzilla.suse.com/1050083
   https://bugzilla.suse.com/1050116
   https://bugzilla.suse.com/1050139
   https://bugzilla.suse.com/1050632
   https://bugzilla.suse.com/1051441
   https://bugzilla.suse.com/1051847
   https://bugzilla.suse.com/1052450
   https://bugzilla.suse.com/1052553
   https://bugzilla.suse.com/1052689
   https://bugzilla.suse.com/1052744
   https://bugzilla.suse.com/1052758
   https://bugzilla.suse.com/1052764
   https://bugzilla.suse.com/1054757
   https://bugzilla.suse.com/1055214
   https://bugzilla.suse.com/1056432
   https://bugzilla.suse.com/1057157
   https://bugzilla.suse.com/1057719
   https://bugzilla.suse.com/1057729
   https://bugzilla.suse.com/1057730
   https://bugzilla.suse.com/1058485
   https://bugzilla.suse.com/1058637
   https://bugzilla.suse.com/1059666
   https://bugzilla.suse.com/1059778
   https://bugzilla.suse.com/1060176
   https://bugzilla.suse.com/1060577
   https://bugzilla.suse.com/1061254
   https://bugzilla.suse.com/1062750
   https://bugzilla.suse.com/1066003
   https://bugzilla.suse.com/1067181
   https://bugzilla.suse.com/1067184
   https://bugzilla.suse.com/1067409

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWjsJrYx+lLeg9Ub1AQhFXA/+N+VfzEXH7rnOC9BJDeDET9SXgS5TeFr6
ovyjEwvrJfRvSLKBDQ0OLn7PUGskww+Dw68nPzGsZe+kccjUdyEmZr1uzpTfRwWA
3nO+Ej5lue/azCM3eI3OIDFmlpGrb/xy/VIUe+sot3NH9CjJrcn4x3Bqglg4XMZA
p52fiZFzbET7XfSHMNT+2wko/vHmG/iHesgFroWKQcwbXp6i9w8HUEpPyRHMeK9U
jbBeRBzzM5qaep0eSKrVRetAYpIcH6OUloi1jyY7ZqxovgVTw199VS1nwrwWa9aR
RfTlpbzmQWO7K6bhNMehW6rdHj5fELbtyVryaL7IoiMbim2m8JERbAHqlg14W9fP
CrMlY8CCC5RoY0hkL2IpgKujarghbA9Vqce0M7WMEFcM8IG6SRxv11tDvVSV7uxZ
MVe5LPE8V7v/plYO1NILBExlF6pRrW//t9z3JMXnB3r2q5su8gMBOFvO8UUf8kS5
So4caNmpLe8KsHUs2NapssknsGE39Ww0HFNsUT51e4GhVjl7Kdh/SRoK3pFB82li
W1iE8uM9jUxgN4JTAwPh3DSrOyRSKuOsZmE7LX7JMxcSUI2tl593O7lRgr+3ibvZ
unNhigik0BwdAMqgJlBlVJ3J3FoC7a++yH1/51JZA1jE5ehVmWkCZI+ZyklWPhiy
RUFyJ9oOuK4=
=MwAz
-----END PGP SIGNATURE-----

« Back to bulletins