Debian Long Term Support / LTS Security Information / 2019 / Security Information -- DLA-1795-1 graphicsmagick

Debian Security Advisory

DLA-1795-1 graphicsmagick -- LTS security update

Date Reported:

21 May 2019

Affected Packages:

graphicsmagick

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2019-11473, CVE-2019-11474, CVE-2019-11505, CVE-2019-11506.

More information:

Multiple vulnerabilities have been discovered in graphicsmagick, the image processing toolkit:

• CVE-2019-11473

  The WriteMATLABImage function (coders/mat.c) is affected by a heap-based buffer overflow. Remote attackers might leverage this vulnerability to cause denial of service or any other unspecified impact via crafted Matlab matrices.

• CVE-2019-11474

  The WritePDBImage function (coders/pdb.c) is affected by a heap-based buffer overflow. Remote attackers might leverage this vulnerability to cause denial of service or any other unspecified impact via a crafted Palm Database file.

• CVE-2019-11505, CVE-2019-11506

  The XWD module (coders/xwd.c) is affected by multiple heap-based buffer overflows and arithmetic exceptions. Remote attackers might leverage these various flaws to cause denial of service or any other unspecified impact via crafted XWD files.

For Debian 8 Jessie, these problems have been fixed in version 1.3.20-3+deb8u7.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS