SUSE-SU-2017:0518-1: moderate: Security update for GraphicsMagick

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for GraphicsMagick
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:0518-1
Rating:             moderate
References:         #1017310 #1017311 #1017312 #1017313 #1017318 
                    #1017321 #1017322 #1017324 #1017326 #1020443 
                    #1020448 
Cross-References:   CVE-2016-10048 CVE-2016-10049 CVE-2016-10050
                    CVE-2016-10051 CVE-2016-10059 CVE-2016-10064
                    CVE-2016-10065 CVE-2016-10068 CVE-2016-10070
                    CVE-2016-10146 CVE-2017-5511
Affected Products:
                    SUSE Studio Onsite 1.3
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that fixes 11 vulnerabilities is now available.

Description:


   This update for GraphicsMagick fixes several issues.

   These security issues were fixed:

   - CVE-2016-10048: Arbitrary module could have been load because relative
     path were not escaped (bsc#1017310).
   - CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to
     a incorrect length calculation (bsc#1017311).
   - CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer
     due to a missing offset check (bsc#1017312).
   - CVE-2016-10051: Fixed use after free when reading PWP files
     (bsc#1017313).
   - CVE-2016-10059: Unchecked calculation when reading TIFF files could have
     lead to a buffer overflow (bsc#1017318).
   - CVE-2016-10064: Improved checks for buffer overflow when reading TIFF
     files (bsc#1017321).
   - CVE-2016-10065: Unchecked calculations when reading VIFF files could
     have lead to out of bound reads (bsc#1017322).
   - CVE-2016-10068: Prevent NULL pointer access when using the MSL
     interpreter (bsc#1017324).
   - CVE-2016-10070: Prevent allocating the wrong amount of memory when
     reading mat files (bsc#1017326).
   - CVE-2016-10146: Captions and labels were handled incorrectly, causing a
     memory leak that could have lead to DoS (bsc#1020443).
   - CVE-2017-5511: A missing cast when reading PSD files could have caused
     memory corruption by a heap overflow (bsc#1020448).


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Studio Onsite 1.3:

      zypper in -t patch slestso13-GraphicsMagick-12994=1

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-GraphicsMagick-12994=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-GraphicsMagick-12994=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Studio Onsite 1.3 (x86_64):

      GraphicsMagick-1.2.5-4.62.1
      libGraphicsMagick2-1.2.5-4.62.1

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      GraphicsMagick-1.2.5-4.62.1
      libGraphicsMagick2-1.2.5-4.62.1
      perl-GraphicsMagick-1.2.5-4.62.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      GraphicsMagick-debuginfo-1.2.5-4.62.1
      GraphicsMagick-debugsource-1.2.5-4.62.1


References:

   https://www.suse.com/security/cve/CVE-2016-10048.html
   https://www.suse.com/security/cve/CVE-2016-10049.html
   https://www.suse.com/security/cve/CVE-2016-10050.html
   https://www.suse.com/security/cve/CVE-2016-10051.html
   https://www.suse.com/security/cve/CVE-2016-10059.html
   https://www.suse.com/security/cve/CVE-2016-10064.html
   https://www.suse.com/security/cve/CVE-2016-10065.html
   https://www.suse.com/security/cve/CVE-2016-10068.html
   https://www.suse.com/security/cve/CVE-2016-10070.html
   https://www.suse.com/security/cve/CVE-2016-10146.html
   https://www.suse.com/security/cve/CVE-2017-5511.html
   https://bugzilla.suse.com/1017310
   https://bugzilla.suse.com/1017311
   https://bugzilla.suse.com/1017312
   https://bugzilla.suse.com/1017313
   https://bugzilla.suse.com/1017318
   https://bugzilla.suse.com/1017321
   https://bugzilla.suse.com/1017322
   https://bugzilla.suse.com/1017324
   https://bugzilla.suse.com/1017326
   https://bugzilla.suse.com/1020443
   https://bugzilla.suse.com/1020448