Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2870
imagemagick security update
13 November 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: imagemagick
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-15277 CVE-2017-14989 CVE-2017-14682
CVE-2017-14607 CVE-2017-14224 CVE-2017-13769
CVE-2017-13758 CVE-2017-12983
Reference: ESB-2017.2697
Original Bulletin:
http://www.debian.org/security/2017/dsa-4032
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4032-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
November 12, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : imagemagick
CVE ID : CVE-2017-12983 CVE-2017-13134 CVE-2017-13758
CVE-2017-13769 CVE-2017-14224 CVE-2017-14607
CVE-2017-14682 CVE-2017-14989 CVE-2017-15277
Debian Bug : 873134 873099 878508 878507 876097 878527 876488 878562
878578
This update fixes several vulnerabilities in imagemagick: Various memory
handling problems and cases of missing or incomplete input sanitising
may result in denial of service, memory disclosure or the execution of
arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files
are processed.
For the stable distribution (stretch), these problems have been fixed in
version 8:6.9.7.4+dfsg-11+deb9u3.
We recommend that you upgrade your imagemagick packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAloIJdEACgkQEMKTtsN8
Tja3QhAAvGjpO9o4J+xHsYWgfuPb9LacPQ4heI7IFOsUySPSWtEYe4pEOIniB4q8
yUF9z17bteAvpEBMzj96Aw20uWqQQP0FnLWnVb4IIUV5R+UXNSO2y0kmoCsMwl9P
7Sguope953mH8g0zm9QiCAe6AYcFkzreh9p8cgzHZfYtJKhhypUPc+ybCgu+gSLS
sAWCarR7qI7Iu+PLzKmoFqRNceigXcudes9wjvEdg90VtPBCOnECsan9T8/1xOgh
pRZ2A7Z6oVe1XahtOWn279Cng3yHykMlCr7rgUI8Xst5UeRxcJGALxapnPhL3gGi
UW4IuzgRME0lEU7025O4+ar/f3IRTIoiBB/rmObI5rFZl6djr4MnGL28fnVxrX44
s9th69LS3Xy73XVDkIS9hSfsHU12puk0GDlktwlps13lcIxqVlW/PoWJ95+abDdG
Ok3M/zRZ3HRniGJ0vWOPgXLVwon5BljOZiM8ILwTyHxijrL5GB0s6cE0TsDzIW1O
wgkbxbfHSG9DXKJUNmuE+U9AoUxBhgrxJ/5YXtdkxwuc0KpkPoy+dbg6KQkgGgjZ
wxlGIXRDEv1NNrIMmz9IX25lOxW+lAlYfWu30Oepa507QXPpr99lR2LaYdSxzK4c
J3NRgJ2NAKR4iwaDxVwUh6Neyr8zw44UYDzak284rhLKOWYORH4=
=mtx5
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWgjwaox+lLeg9Ub1AQiDCQ//STjvf+TXrofga51eiG2SQOpLAZd3Npn+
jhQoBhQuGBcfLdpQ69j2mJIIr6ueck0WeoYZibQplFrwY8SrqHdR0Oblp/XYg9Qy
D7iqKI4vkqLlVaxoIBSsdbEiyLHSGMIhXd5EQ3BEiF4GpC7qBqnjVySAf4Eb6aT4
BSVDEWPy9iZf6sToV5oZFH7D411y/QzZr7eBntaZfF8ueqC/jg5rJ6lh7XgL4ic3
q92Z2yqe/DeRckYZF3RJ5a2IlYTu+bbXzijcx1vo2sybIlUupq+nNcNNxlCAGL0e
lcnezJV0ArtkhvnCIuWea0562yWyuPztE6iVcRli2o4I538ndzJG5IlOFUdH5LrP
yocnz+mYCdtvCWHuXrF318PkGakAn8iGgNVK0QsBFkoVKGZwaLgW5Md7O44gvz+S
4C7lmwJySEXeK75ibPwWWHc119aOzAQFf8fmh7NySu2bGCbtFQryt5LPCtYfkBu+
PjVm94FZPhl/JR5t1x6U9LFpXcSgyS/nWkvqFUUky1YAyprksVAiIHeLBbRWkEnv
XYfczHZFGHxB9EsBi3EQ/3z0b1HAT9kgVLdqrdGVx9hG5tDk73vLjvkKEjKExYK5
1//JoNit4Ov1exXR1BN5R82gJ1bNz992D5JXvwgL5UZ2HyUWnNGxmliBuJ+5RdLa
PXmmSQz1ca0=
=EsNe
-----END PGP SIGNATURE-----