Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3138.2
graphicsmagick security update
29 October 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: graphicsmagick
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-9018 CVE-2018-6799 CVE-2018-5685
CVE-2017-18231 CVE-2017-18230 CVE-2017-18229
CVE-2017-18220 CVE-2017-18219 CVE-2017-17915
CVE-2017-17913 CVE-2017-17912 CVE-2017-17783
CVE-2017-17782 CVE-2017-17503 CVE-2017-17502
CVE-2017-17501 CVE-2017-17500 CVE-2017-17498
CVE-2017-16669 CVE-2017-16547 CVE-2017-16545
CVE-2017-16353 CVE-2017-16352 CVE-2017-15930
CVE-2017-15277 CVE-2017-15238 CVE-2017-14997
CVE-2017-14994 CVE-2017-14733 CVE-2017-14504
CVE-2017-14314 CVE-2017-13777 CVE-2017-13776
CVE-2017-13775 CVE-2017-13737 CVE-2017-13134
CVE-2017-13065 CVE-2017-13064 CVE-2017-13063
CVE-2017-12937 CVE-2017-12936 CVE-2017-12935
CVE-2017-11722 CVE-2017-11643 CVE-2017-11642
CVE-2017-11641 CVE-2017-11638 CVE-2017-11637
CVE-2017-11636 CVE-2017-11403 CVE-2017-11140
CVE-2017-11139 CVE-2017-11102 CVE-2017-10800
CVE-2017-10799 CVE-2017-10794
Reference: ESB-2018.2249
ESB-2018.1883
ESB-2018.0926
ESB-2018.0018
ESB-2017.3251
Original Bulletin:
http://www.debian.org/security/2018/dsa-4321
Revision History: October 29 2018: Update of Graphicsmagick in DSA-4321-1
introduced a change that affects some code
built against the GraphicsMagick libraries.
This update restores the previous behaviour.
October 17 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4321-2 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 28, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : graphicsmagick
The update of Graphicsmagick in DSA-4321-1 introduced a change in the
handling of case-sensitivity in an internal API function which could
affect some code built against the GraphicsMagick libraries. This update
restores the previous behaviour.
For the stable distribution (stretch), these problems have been fixed in
version 1.3.30+hg15796-1~deb9u2.
We recommend that you upgrade your graphicsmagick packages.
For the detailed security status of graphicsmagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphicsmagick
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlvWBIcACgkQEMKTtsN8
TjZFQg/+Mf104iNPJBI/fBdiEQCJjXeCwdEosodGA4nl9VYGjBVMbZNVhLaSxOAt
E5zWFDkgvngJjVbZ6Z8qVALSLoxr0pV6Pmrqf+T3jvMwiEJ3UxjwzFnNs1XaG+UL
G5OeDH0oy00rdBHF2BJVYYQmcdmM0iXaJLp759YywEPj4IQd90fZWFvFPIsOjyQT
7xDTNOwXq6cCZaQpcl6En1VAvntfwSWCE15xyMU+jRq2JCgEvtgjNjyB5+uUrsG0
jCU2Y9en4UyQWY0/xwfQGDazW0wb3C9mucFZk0zfFPqL8moSrmWgl3vVEt2jCumc
MKCP+JV2OQ/OAf4cqIdhn5yI2Mw3ofCCT/pDxzapAT0NnFyIrts6wJQY1HESCkyW
YTRpdPNxWMx5HZm9SCIIANxEzNBLcHAExb0mdAV0CTLU0m7fgSBZdQeVQ0bMiQD9
/OQUuriOxf73bBp4H+ucWxshlHs+T5iJR9Vd7K8sXcC+MgpeLSuytZzq8J1GlfjR
QViAih/pBaSioNZqe04JFWGEszb85NBjuK3fymr9pUDWdZapblutRnuqJMUlO6kw
VsvDmp9Pe1jEKsyUmBVAOlQyoLXY9KjNw1Cpvj4cLnC1VkPHRfO2rIj0YmPm8OTU
3IIDTiW7F5SDXDPNUShObueO//vJqSFg9GFYQw128aolMvDYitI=
=VUVT
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4321-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 16, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : graphicsmagick
CVE ID : CVE-2017-10794 CVE-2017-10799 CVE-2017-10800 CVE-2017-11102
CVE-2017-11139 CVE-2017-11140 CVE-2017-11403 CVE-2017-11636
CVE-2017-11637 CVE-2017-11638 CVE-2017-11641 CVE-2017-11642
CVE-2017-11643 CVE-2017-11722 CVE-2017-12935 CVE-2017-12936
CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065
CVE-2017-13134 CVE-2017-13737 CVE-2017-13775 CVE-2017-13776
CVE-2017-13777 CVE-2017-14314 CVE-2017-14504 CVE-2017-14733
CVE-2017-14994 CVE-2017-14997 CVE-2017-15238 CVE-2017-15277
CVE-2017-15930 CVE-2017-16352 CVE-2017-16353 CVE-2017-16545
CVE-2017-16547 CVE-2017-16669 CVE-2017-17498 CVE-2017-17500
CVE-2017-17501 CVE-2017-17502 CVE-2017-17503 CVE-2017-17782
CVE-2017-17783 CVE-2017-17912 CVE-2017-17913 CVE-2017-17915
CVE-2017-18219 CVE-2017-18220 CVE-2017-18229 CVE-2017-18230
CVE-2017-18231 CVE-2018-5685 CVE-2018-6799 CVE-2018-9018
Several vulnerabilities have been discovered in GraphicsMagick, a set of
command-line applications to manipulate image files, which could result
in denial of service or the execution of arbitrary code if malformed
image files are processed.
For the stable distribution (stretch), these problems have been fixed in
version 1.3.30+hg15796-1~deb9u1.
We recommend that you upgrade your graphicsmagick packages.
For the detailed security status of graphicsmagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphicsmagick
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlvGXNMACgkQEMKTtsN8
Tjba/g//bgDyCTHYRz8AIo204yq3EveuxeIebXL+QEjBX/anhLOAEPvxnuV8nVyo
S6f2nNp++jCjVh0W2OPUC2FsyzXUMk1erx5YISdDoRNE1Vfp52UmmtwQqz0PRIdq
GNg00drSZUq/gT6zb3cR2ahHSRN6O5xc0jEyetX9nTyS80gbDn5LY1G4R2ox9PxI
Ka4RdHklo6AGPuaaxbo0dK0LOYR/fOMXxXTwBNRbC6vvklfQD2t0X6+qu/5cMqHI
AhtBI0d9rRfMTG9tFv2lQum5nvINstIOTXZbpAR/SrtC83ozdP0i3HTCk5Z+D0md
uT50Lz57UclDK4WUNsdSvulILNfu4bfLIvtQIGQTLzFcbOI5v8vWEmwOXTxYjFc4
ukBSCpZcoXCBeVbSmf9Oxx0UnvYnQOJs2lXuFMj3qY8xNJps0ADUk6QCZhpEwVzs
f1uR/FQSQej9or11ZKb1tXuqjlutjoXdgkcMEhhaEgvEkr4efBywndEU3YYoep5D
htTVo2ZnjT9RFe+oOlnF4VKqan07HBxPwA3ehvTZcHwTVCCoxvRMSzmInmuR+GFh
T+mk7A7JXYmXwnQjKRifWPndZ3Gowc+fg9UnxXpTiXHCGR7SSV1ZwJNaJh/t9OQs
qWJ/NjBam3wX9rOIi79QLQj1lNpTRPSQMoKiq3leMo7bKOgTIm4=
=dx0e
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW9ZttmaOgq3Tt24GAQj4vA//R6LrvxY4gfWJZFW5UbSiJyawRyYYoapU
1RlXWS8QrSfvZ6t8d8K7DvXUr28K29a8dx5qU6BZVL+LjNe/+ttIXdE3dm7n4pgE
5QheYmIAf3wVtBOSY5I67Xjd1/A0XVAT2ZoP2vRXqHew1+MiEE6A33hkIp5/r0mm
xBGUUquyYB47+Qj6JSQcLwh1iHs+ATu8oI2JLX+bErQp/1jCuCFtoDu38LAJaUyk
ypV01IgpNYXPsB0jgmvKpuPl2W7S62rhco5dKCgtSRhFX3qkqr0eHE/kU08unn1d
BZjbUcfhA27ou582JNRSsJhSyV0qrF6OAUR5fcI8Qvme9WhWGO/W79JXOsixzgwx
nV/fR2LHM/4j2cTR9QFRRMVIG+2yNgazESHDTTnfheaAGPxyFAQg6jlUOgv9L6c+
ccnVESI3XgNJBJoW6/khjJrlYRgyyz70p3iuAJNoqsEQR7QMhaCTkY1xZIJDqqdR
8vmgaZQae/3WCbgaXpo+9pA2JoYkE5zgQI9eENhcjIud4rU6FgVqf8OiwJARG66F
0IW6J4PuUAWp0S1gusFezgmeuLQ/0VbGs/91PuRY/4jy/6kGRtWco7t2MfkLT2RN
MxCUOFQbKRJrtzX4YipnOfuawfSScfzHAQbKfNgtYDCEU1tA90dBpoCDn7MvoOyd
z60nHkk3qLs=
=TeVX
-----END PGP SIGNATURE-----