Debian Security Advisory

DLA-1795-1 graphicsmagick -- LTS security update

Date Reported:
21 May 2019
Affected Packages:
graphicsmagick
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2019-11473, CVE-2019-11474, CVE-2019-11505, CVE-2019-11506.
More information:

Multiple vulnerabilities have been discovered in graphicsmagick, the image processing toolkit:

  • CVE-2019-11473

    The WriteMATLABImage function (coders/mat.c) is affected by a heap-based buffer overflow. Remote attackers might leverage this vulnerability to cause denial of service or any other unspecified impact via crafted Matlab matrices.

  • CVE-2019-11474

    The WritePDBImage function (coders/pdb.c) is affected by a heap-based buffer overflow. Remote attackers might leverage this vulnerability to cause denial of service or any other unspecified impact via a crafted Palm Database file.

  • CVE-2019-11505, CVE-2019-11506

    The XWD module (coders/xwd.c) is affected by multiple heap-based buffer overflows and arithmetic exceptions. Remote attackers might leverage these various flaws to cause denial of service or any other unspecified impact via crafted XWD files.

For Debian 8 Jessie, these problems have been fixed in version 1.3.20-3+deb8u7.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS