ALASGRAPHICSMAGICK1.3-2023-001

Amazon Linux 2 Security Advisory: ALASGRAPHICSMAGICK1.3-2023-001
Advisory Release Date: 2023-07-19 21:52 Pacific
Advisory Updated Date: 2024-02-15 04:09 Pacific
Severity: Important
Issue Overview:

2024-02-15: CVE-2020-21679 was added to this advisory.

Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format. (CVE-2020-21679)

In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. (CVE-2022-1270)


Affected Packages:

GraphicsMagick


Note:

This advisory is applicable to Amazon Linux 2 - Graphicsmagick1.3 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update GraphicsMagick to update your system.

New Packages:
aarch64:
    GraphicsMagick-1.3.38-1.amzn2.0.5.aarch64
    GraphicsMagick-devel-1.3.38-1.amzn2.0.5.aarch64
    GraphicsMagick-perl-1.3.38-1.amzn2.0.5.aarch64
    GraphicsMagick-c++-1.3.38-1.amzn2.0.5.aarch64
    GraphicsMagick-c++-devel-1.3.38-1.amzn2.0.5.aarch64
    GraphicsMagick-debuginfo-1.3.38-1.amzn2.0.5.aarch64

noarch:
    GraphicsMagick-doc-1.3.38-1.amzn2.0.5.noarch

src:
    GraphicsMagick-1.3.38-1.amzn2.0.5.src

x86_64:
    GraphicsMagick-1.3.38-1.amzn2.0.5.x86_64
    GraphicsMagick-devel-1.3.38-1.amzn2.0.5.x86_64
    GraphicsMagick-perl-1.3.38-1.amzn2.0.5.x86_64
    GraphicsMagick-c++-1.3.38-1.amzn2.0.5.x86_64
    GraphicsMagick-c++-devel-1.3.38-1.amzn2.0.5.x86_64
    GraphicsMagick-debuginfo-1.3.38-1.amzn2.0.5.x86_64

Additional References

Red Hat: CVE-2020-21679, CVE-2022-1270

Mitre: CVE-2020-21679, CVE-2022-1270