SUSE-SU-2017:3056-1: moderate: Security update for GraphicsMagick

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for GraphicsMagick
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:3056-1
Rating:             moderate
References:         #1050135 #1054596 #1054598 #1055042 #1055050 
                    #1055430 #1061873 
Cross-References:   CVE-2017-11534 CVE-2017-12936 CVE-2017-12937
                    CVE-2017-13063 CVE-2017-13064 CVE-2017-13139
                    CVE-2017-15033
Affected Products:
                    SUSE Studio Onsite 1.3
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that fixes 7 vulnerabilities is now available.

Description:

   This update for GraphicsMagick fixes the following issues:

   - CVE-2017-15033: A denial of service attack (memory leak) in ReadYUVImage
     in coders/yuv.c was fixed (bsc#1061873)
   - CVE-2017-13063: A heap-based buffer overflow vulnerability in the
     function GetStyleTokens in coders/svg.c was fixed (bsc#1055050)
   - CVE-2017-13064: A heap-based buffer overflow vulnerability in the
     function GetStyleTokens in coders/svg.c was fixed (bsc#1055042)
   - CVE-2017-12936: The ReadWMFImage function in coders/wmf.c in
     GraphicsMagick had a use-after-free issue for data associated with
     exception reporting.  (bsc#1054598)
   - CVE-2017-13139: The ReadOneMNGImage function in coders/png.c had an
     out-of-bounds read with the MNG CLIP chunk.  (bsc#1055430)
   - CVE-2017-12937: The ReadSUNImage function in coders/sun.c in
     GraphicsMagick had a colormap heap-based buffer over-read.  (bsc#1054596)
   - CVE-2017-11534: A Memory Leak in the lite_font_map() function in
     coders/wmf.c was fixed (bsc#1050135)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Studio Onsite 1.3:

      zypper in -t patch slestso13-GraphicsMagick-13347=1

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-GraphicsMagick-13347=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-GraphicsMagick-13347=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Studio Onsite 1.3 (x86_64):

      GraphicsMagick-1.2.5-4.78.16.1
      libGraphicsMagick2-1.2.5-4.78.16.1

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      GraphicsMagick-1.2.5-4.78.16.1
      libGraphicsMagick2-1.2.5-4.78.16.1
      perl-GraphicsMagick-1.2.5-4.78.16.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      GraphicsMagick-debuginfo-1.2.5-4.78.16.1
      GraphicsMagick-debugsource-1.2.5-4.78.16.1


References:

   https://www.suse.com/security/cve/CVE-2017-11534.html
   https://www.suse.com/security/cve/CVE-2017-12936.html
   https://www.suse.com/security/cve/CVE-2017-12937.html
   https://www.suse.com/security/cve/CVE-2017-13063.html
   https://www.suse.com/security/cve/CVE-2017-13064.html
   https://www.suse.com/security/cve/CVE-2017-13139.html
   https://www.suse.com/security/cve/CVE-2017-15033.html
   https://bugzilla.suse.com/1050135
   https://bugzilla.suse.com/1054596
   https://bugzilla.suse.com/1054598
   https://bugzilla.suse.com/1055042
   https://bugzilla.suse.com/1055050
   https://bugzilla.suse.com/1055430
   https://bugzilla.suse.com/1061873