Bugzilla – Full Text Bug Listing |
Summary: | VUL-0: CVE-2017-15033: GraphicsMagick,ImageMagick: denial of service (memory leak) in ReadYUVImage in coders/yuv.c | ||
---|---|---|---|
Product: | [Novell Products] SUSE Security Incidents | Reporter: | Alexander Bergmann <abergmann> |
Component: | Incidents | Assignee: | Security Team bot <security-team> |
Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
Severity: | Normal | ||
Priority: | P3 - Medium | CC: | abergmann, pgajdos, smash_bz |
Version: | unspecified | ||
Target Milestone: | --- | ||
Hardware: | Other | ||
OS: | Other | ||
URL: | https://smash.suse.de/issue/192858/ | ||
Whiteboard: | CVSSv2:SUSE:CVE-2017-15033:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3:SUSE:CVE-2017-15033:5.3:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVSSv3:RedHat:CVE-2017-15033:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv2:NVD:CVE-2017-15033:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) | ||
Found By: | Security Response Team | Services Priority: | |
Business Priority: | Blocker: | --- | |
Marketing QA Status: | --- | IT Deployment: | --- |
Description
Alexander Bergmann
2017-10-05 14:51:59 UTC
No QA reproducer available. Affected: all codestreams, including GraphicsMagick. Also GraphicsMagick hg partially affected, author notified. I believe all fixed, packages submitted. This is an autogenerated message for OBS integration: This bug (1061873) was mentioned in https://build.opensuse.org/request/show/532233 42.2 / GraphicsMagick https://build.opensuse.org/request/show/532234 42.3 / GraphicsMagick GraphicsMagick upstream noted that ThrowException does not return, so relevant hunk is wrong. I will resubmit GraphicsMagick. This is an autogenerated message for OBS integration: This bug (1061873) was mentioned in https://build.opensuse.org/request/show/532710 42.3 / GraphicsMagick https://build.opensuse.org/request/show/532711 42.2 / GraphicsMagick openSUSE-SU-2017:2735-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1059663,1061873 CVE References: CVE-2017-14532,CVE-2017-15033 Sources used: openSUSE Leap 42.3 (src): GraphicsMagick-1.3.25-27.1 openSUSE Leap 42.2 (src): GraphicsMagick-1.3.25-11.27.1 SUSE-SU-2017:2949-1: An update that fixes 9 vulnerabilities is now available. Category: security (moderate) Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873 CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Workstation Extension 12-SP2 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Server 12-SP3 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Server 12-SP2 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Desktop 12-SP3 (src): ImageMagick-6.8.8.1-71.12.1 SUSE Linux Enterprise Desktop 12-SP2 (src): ImageMagick-6.8.8.1-71.12.1 openSUSE-SU-2017:2999-1: An update that fixes 9 vulnerabilities is now available. Category: security (moderate) Bug References: 1049379,1050135,1052249,1052253,1052545,1054924,1055219,1055430,1061873 CVE References: CVE-2016-7530,CVE-2017-11446,CVE-2017-11534,CVE-2017-12428,CVE-2017-12431,CVE-2017-12433,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033 Sources used: openSUSE Leap 42.3 (src): ImageMagick-6.8.8.1-37.1 openSUSE Leap 42.2 (src): ImageMagick-6.8.8.1-30.9.1 SUSE-SU-2017:3056-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1050135,1054596,1054598,1055042,1055050,1055430,1061873 CVE References: CVE-2017-11534,CVE-2017-12936,CVE-2017-12937,CVE-2017-13063,CVE-2017-13064,CVE-2017-13139,CVE-2017-15033 Sources used: SUSE Studio Onsite 1.3 (src): GraphicsMagick-1.2.5-4.78.16.1 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): GraphicsMagick-1.2.5-4.78.16.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): GraphicsMagick-1.2.5-4.78.16.1 SUSE-SU-2017:3168-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1050135,1055219,1055430,1061873 CVE References: CVE-2017-11534,CVE-2017-13133,CVE-2017-13139,CVE-2017-15033 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): ImageMagick-6.4.3.6-7.78.8.1 SUSE Linux Enterprise Server 11-SP4 (src): ImageMagick-6.4.3.6-7.78.8.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): ImageMagick-6.4.3.6-7.78.8.1 released |