Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0110
imagemagick security update
13 January 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: imagemagick
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-29599 CVE-2020-27773 CVE-2020-27765
CVE-2020-27763 CVE-2020-27760 CVE-2020-27750
CVE-2020-27560 CVE-2020-25674 CVE-2020-25665
CVE-2020-19667 CVE-2017-14528
Reference: ESB-2021.0038
ESB-2020.4411
ESB-2020.3913
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2523-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/
January 12, 2021 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : imagemagick
Version : 8:6.9.7.4+dfsg-11+deb9u11
CVE ID : CVE-2017-14528 CVE-2020-19667 CVE-2020-25665 CVE-2020-25674
CVE-2020-27560 CVE-2020-27750 CVE-2020-27760 CVE-2020-27763
CVE-2020-27765 CVE-2020-27773 CVE-2020-29599
Debian Bug : 878544 972797 977205
Several security vulnerabilities were found in ImageMagick, a suite of
image manipulation programs. An attacker could cause denial of service
and execution of arbitrary code when a crafted image file is
processed.
CVE-2017-14528
The TIFFSetProfiles function in coders/tiff.c has incorrect
expectations about whether LibTIFF TIFFGetField return values
imply that data validation has occurred, which allows remote
attackers to cause a denial of service (use-after-free after an
invalid call to TIFFSetField, and application crash) via a crafted
file.
CVE-2020-19667
Stack-based buffer overflow and unconditional jump in ReadXPMImage
in coders/xpm.c
CVE-2020-25665
The PALM image coder at coders/palm.c makes an improper call to
AcquireQuantumMemory() in routine WritePALMImage() because it
needs to be offset by 256. This can cause a out-of-bounds read
later on in the routine. This could cause impact to reliability.
CVE-2020-25674
WriteOnePNGImage() from coders/png.c (the PNG coder) has a for
loop with an improper exit condition that can allow an
out-of-bounds READ via heap-buffer-overflow. This occurs because
it is possible for the colormap to have less than 256 valid values
but the loop condition will loop 256 times, attempting to pass
invalid colormap data to the event logger.
CVE-2020-27560
ImageMagick allows Division by Zero in OptimizeLayerFrames in
MagickCore/layer.c, which may cause a denial of service.
CVE-2020-27750
A flaw was found in MagickCore/colorspace-private.h and
MagickCore/quantum.h. An attacker who submits a crafted file that
is processedcould trigger undefined behavior in the form of values
outside the range of type `unsigned char` and math division by
zero. This would most likely lead to an impact to application
availability, but could potentially cause other problems related
to undefined behavior.
CVE-2020-27760
In `GammaImage()` of /MagickCore/enhance.c, depending on the
`gamma` value, it's possible to trigger a divide-by-zero condition
when a crafted input file is processed by ImageMagick. This could
lead to an impact to application availability.
CVE-2020-27763
A flaw was found in MagickCore/resize.c. An attacker who submits a
crafted file that is processed by ImageMagick could trigger
undefined behavior in the form of math division by zero. This
would most likely lead to an impact to application availability,
but could potentially cause other problems related to undefined
behavior.
CVE-2020-27765
A flaw was found in MagickCore/segment.c. An attacker who submits
a crafted file that is processed by ImageMagick could trigger
undefined behavior in the form of math division by zero. This
would most likely lead to an impact to application availability,
but could potentially cause other problems related to undefined
behavior.
CVE-2020-27773
A flaw was found in MagickCore/gem-private.h. An attacker who
submits a crafted file that is processed by ImageMagick could
trigger undefined behavior in the form of values outside the range
of type `unsigned char` or division by zero. This would most
likely lead to an impact to application availability, but could
potentially cause other problems related to undefined behavior.
CVE-2020-29599
ImageMagick mishandles the -authenticate option, which allows
setting a password for password-protected PDF files. The
user-controlled password was not properly escaped/sanitized and it
was therefore possible to inject additional shell commands via
coders/pdf.c.
For Debian 9 stretch, these problems have been fixed in version
8:6.9.7.4+dfsg-11+deb9u11.
We recommend that you upgrade your imagemagick packages.
For the detailed security status of imagemagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl/93REACgkQj/HLbo2J
BZ9dTwf+OquA6Hn9JslevO+QRmx5TQw/8WwhsVRTylhPX1BE7WxCy2UDzwmECQVq
e2AihD3//rJovN8RMNxnpMbuOCAMaAZRQTTQHbgX7jJBdzj47EEvmtdNxYDzoa1v
BlQkUpvVoLQcui+4HQJxk8ZpxygE9xPow57N05Fy7HZvcd2wBm9V2wkvpS4qu+VR
BqYDuSY3NiAIaRlGs5kC+AHFZ8X8cmi1RTEGko5A8PYLuYcd4ErqhwxvoIH+kK0t
rP3gA1wPwm1W+d/GZ2hiShqcW6W0EndIBHCFGOqfP09lIKGOdjBqNY5xm2dlXOa0
TWt0guMN8IfQILglaIqqH32bY0xaOg==
=SMWK
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX/5/xeNLKJtyKPYoAQj0FA//eTBzAxYAK50nqzrqFvqSYqqKDTG6T8v8
CRm3NK2DNJMAON7YeEZdYvHXC0MhgV7jsJ6/h+c5Snwr6YLB+uCSAP4MAhysT5gM
UnO54NZ+c4H+ArouJRGny2qPYjlMnzOvyy2gI2eMDVr3jkCycdg7FOhAJNxKzhEo
jaqY7B/EiZ5WHVM2GfP7RAy4UATS9YxtJXbPgBOmQF+nKiDIe+CgmWsHYdrx5T0d
xXkIbjQUMINyI+suQEqmAu4qeYZ3Wh6dl+HvvXT3jw/b37OJeCVsr0sEDMDvTyLP
H4LUpp1T6Xs163U2/zToJ8yuq8PNodVtpNuuZdl5arow2oegwoOjvgr+K6nBqmN5
GQarvXXZ0pOrzSPYigU3igtRMeTeNytMfGPzYPsOOsl0vAp+V2blSfdfR1uH+5Va
y2CC0OCg5B6oLRfRtmhOzEAOqxPBQI6/09o4jawf1gC6eTpRLiccnKyVt+TmmPf6
m2F7SKu0Wk4yJfrl3xDE0HXvQRJdpXzYPQoX7xY0liu3kE78qSaSgDFtCnDRtdut
Bm+8vi9QAYjTk03WIUH4NxvLtUrP7L2Oxm1vLOlNRxlX1QFQyjTPEus6JvLoehQy
jFu0ZgkuU0fGm9ROknrfR/JOrfW0ECOLl87/RLKB0667zw16UAXB4YlpNJtpqcpp
b2pYiZ2yGeM=
=GwDx
-----END PGP SIGNATURE-----