Bug 1061873 (CVE-2017-15033)

Summary: VUL-0: CVE-2017-15033: GraphicsMagick,ImageMagick: denial of service (memory leak) in ReadYUVImage in coders/yuv.c
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: abergmann, pgajdos, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/192858/
Whiteboard: CVSSv2:SUSE:CVE-2017-15033:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3:SUSE:CVE-2017-15033:5.3:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVSSv3:RedHat:CVE-2017-15033:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv2:NVD:CVE-2017-15033:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2017-10-05 14:51:59 UTC
CVE-2017-15033

ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in
coders/yuv.c.

Upstream fix:
https://github.com/ImageMagick/ImageMagick/commit/ef8f40689ac452398026c07da41656a7c87e4683

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15033
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15033
Comment 1 Alexander Bergmann 2017-10-05 14:53:10 UTC
No QA reproducer available.
Comment 2 Petr Gajdos 2017-10-06 13:56:50 UTC
Affected: all codestreams, including GraphicsMagick. Also GraphicsMagick hg partially affected, author notified.
Comment 3 Petr Gajdos 2017-10-06 13:58:40 UTC
I believe all fixed, packages submitted.
Comment 4 Bernhard Wiedemann 2017-10-06 14:02:06 UTC
This is an autogenerated message for OBS integration:
This bug (1061873) was mentioned in
https://build.opensuse.org/request/show/532233 42.2 / GraphicsMagick
https://build.opensuse.org/request/show/532234 42.3 / GraphicsMagick
Comment 6 Petr Gajdos 2017-10-09 10:02:29 UTC
GraphicsMagick upstream noted that ThrowException does not return, so relevant hunk is wrong. I will resubmit GraphicsMagick.
Comment 7 Bernhard Wiedemann 2017-10-09 12:00:55 UTC
This is an autogenerated message for OBS integration:
This bug (1061873) was mentioned in
https://build.opensuse.org/request/show/532710 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/532711 42.2 / GraphicsMagick
Comment 11 Swamp Workflow Management 2017-10-16 22:11:27 UTC
openSUSE-SU-2017:2735-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1059663,1061873
CVE References: CVE-2017-14532,CVE-2017-15033
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-27.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.27.1
Comment 14 Swamp Workflow Management 2017-11-08 11:19:13 UTC
SUSE-SU-2017:2949-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873
CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.12.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.12.1
Comment 15 Swamp Workflow Management 2017-11-12 17:12:53 UTC
openSUSE-SU-2017:2999-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873
CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-37.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.9.1
Comment 16 Swamp Workflow Management 2017-11-23 20:08:34 UTC
SUSE-SU-2017:3056-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1050135,1054596,1054598,1055042,1055050,1055430,1061873
CVE References: CVE-2017-11534,CVE-2017-12936,CVE-2017-12937,CVE-2017-13063,CVE-2017-13064,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.16.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.16.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.16.1
Comment 17 Swamp Workflow Management 2017-12-01 02:07:47 UTC
SUSE-SU-2017:3168-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1050135,1055219,1055430,1061873
CVE References: CVE-2017-11534,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.8.1
Comment 18 Marcus Meissner 2018-02-12 08:40:43 UTC
released