Amazon Linux 1 Security Advisory: ALAS-2017-820
Advisory Release Date: 2017-04-20 06:08 Pacific
Advisory Updated Date: 2017-04-20 21:54 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.(CVE-2017-6335)
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.(CVE-2016-7997)
Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries. (CVE-2016-7996 )
The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file." (CVE-2016-8684)
The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header. (CVE-2016-8682)
The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file." (CVE-2016-8683)
The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image. (CVE-2016-9830)
Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow. (CVE-2016-7800 )
Affected Packages:
GraphicsMagick
Issue Correction:
Run yum update GraphicsMagick to update your system.
i686:
GraphicsMagick-c++-devel-1.3.25-6.10.amzn1.i686
GraphicsMagick-devel-1.3.25-6.10.amzn1.i686
GraphicsMagick-debuginfo-1.3.25-6.10.amzn1.i686
GraphicsMagick-perl-1.3.25-6.10.amzn1.i686
GraphicsMagick-1.3.25-6.10.amzn1.i686
GraphicsMagick-c++-1.3.25-6.10.amzn1.i686
noarch:
GraphicsMagick-doc-1.3.25-6.10.amzn1.noarch
src:
GraphicsMagick-1.3.25-6.10.amzn1.src
x86_64:
GraphicsMagick-devel-1.3.25-6.10.amzn1.x86_64
GraphicsMagick-perl-1.3.25-6.10.amzn1.x86_64
GraphicsMagick-debuginfo-1.3.25-6.10.amzn1.x86_64
GraphicsMagick-1.3.25-6.10.amzn1.x86_64
GraphicsMagick-c++-devel-1.3.25-6.10.amzn1.x86_64
GraphicsMagick-c++-1.3.25-6.10.amzn1.x86_64