ESB-2018.0472 - [Debian] graphicsmagick: Denial of service - Remote with user interaction 2018-02-16

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0472
  A denial of service vulnerability has been discovered in graphicsmagick
                             16 February 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           graphicsmagick
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
Impact/Access:     Denial of Service -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-6799  

Reference:         ESB-2018.0468

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2018/02/msg00017.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Package        : graphicsmagick
Version        : 1.3.16-1.1+deb7u18
CVE ID         : CVE-2018-6799


A denial of service vulnerability has been discovered in graphicsmagick,
a collection of image processing tools and associated libraries.

A specially crafted file can be used to produce a denial of service
(heap overwrite) or possible other unspecified impact by exploiting a
defect related to unused pixel staging area in the AcquireCacheNexus
function in magick/pixel_cache.c.

For Debian 7 "Wheezy", these problems have been fixed in version
1.3.16-1.1+deb7u18.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWoYyLox+lLeg9Ub1AQgFUw//ZSOWnL8sEbtxLghSVUJ0q2WWnj3vTjj1
viGt/hgXrQ7H6WaUVo3hVS7LmIM4Ci7EdFxen/VDKVSXix6UaO8/jQKt0NmSxL9h
oHXCY/u1t50DQFwCwIXpWqp594o57kdaU6F1KvJNSQ7r0NDXgj8Ntacqh8siJ1Q7
6zsQmaO1CauUfu0qTEo26LxybNLKlFgfJ7NRKHh1gseF59g2ugKoeesXLBJ2hJ8h
dJkvwvPmATUUaJHY7RSG9AUY3rstE7JxPbMmZD4r/RPReG1gEqHA67IC21L3yVM7
lIziEZ585oovClb/831leTL6gwTGpcZUGOn6at1jEy5IIYmCzES5yV8Gt3dk5LYn
Ci6MKkcplNNuucArHgG7OeqcAbt49mcaxx4KO8Uvo8kTigXJrry8RFlIe5oCRuPg
4NZ7ajbZ6O/bGB3OMjRpc4NlPK6opkwdoGXXVgEu09dVpPPKrrtu+q8fy+VAQLx4
EBAA09zWVxw7Yqeq4edqdfInOgvlHcqQtO+lMPPD2sFGQFGFBUnPmCUhRmSGSwbH
X7Nrt0tbS4YLjfQ+omhvVnknWrtRBzZ21zG52FXhsPO4upt/qJB9dzXEF7e1Bom3
dHB6L9cQwK54j5Q2HvysjY6/C5WNeZZCq3ODilQKOQrQBb3Za9pgXElqDQ+DN+p2
KUyXlmexuOw=
=3JGb
-----END PGP SIGNATURE-----

« Back to bulletins