Bug 1111072 (CVE-2018-18016)

Summary: VUL-1: CVE-2018-18016: GraphicsMagick,ImageMagick: ImageMagick: memory leak in WritePCXImage in coders/pcx.c
Product: [Novell Products] SUSE Security Incidents Reporter: Karol Babioch <karol>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P4 - Low CC: pgajdos, rfrohl, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/216234/
Whiteboard: CVSSv3:RedHat:CVE-2018-18016:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv3:SUSE:CVE-2018-18016:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv2:NVD:CVE-2018-18016:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2018-18016:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Comment 1 Robert Frohl 2018-10-10 14:06:21 UTC
Hi Petr,

After looking into the issue I think everything is already fixed, but I would like to get a confirmation.

- SUSE:SLE-15:Update/ImageMagick already fixed

The following codestreams seem to be fixed by bsc#1055069 (by "*Magick-CVE-2017-13058.patch", upstream ticket [0]). Which would mean that CVE-2018-18016 duplicates CVE-2017-13058.

- SUSE:SLE-12:Update/ImageMagick seems to be fixed by bsc#1055069 
- SUSE:SLE-11:Update/ImageMagick seems to be fixed by bsc#1055069
- SUSE:SLE-11:Update/GraphicsMagick seems to be fixed by bsc#1055069 


[0] https://github.com/ImageMagick/ImageMagick/issues/666
Comment 2 Petr Gajdos 2018-10-11 06:12:23 UTC
Thanks for analysis.

Setting needinfo to me when the bug is assigned to me is pointless ;).
Comment 3 Petr Gajdos 2018-10-11 08:26:48 UTC
Filled new issue upstream:
https://github.com/ImageMagick/ImageMagick/issues/1347
Comment 4 Petr Gajdos 2018-10-11 08:27:26 UTC
I will consider CVE-2018-18016 a bit broader: free page_table where needed.
Comment 5 Petr Gajdos 2018-10-11 12:07:51 UTC
(In reply to Petr Gajdos from comment #4)
> I will consider CVE-2018-18016 a bit broader: free page_table where needed.

Actually, no. How to get out from this? Let's try:

15/ImageMagick: 

Patch for upstream issue #1347:
ImageMagick-WritePCXImage-page_table-memory-leak.patch
to be renamed to ImageMagick-2018-xxxxx.patch as soon as it gets a CVE.

11,12/ImageMagick, 11/GraphicsMagick:

ImageMagick-CVE-2017-13058.patch already contains all fixes, but not completely correct. Instead of just

page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);

there have to be
if (page_table != (MagickOffsetType *) NULL)
  page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);

as page_table can be NULL in So I will fix it and, at the same time, I will rename the patch to ImageMagick-CVE-2017-13058,CVE-2018-18016.patch
Comment 6 Petr Gajdos 2018-10-11 12:09:18 UTC
Will submit for 15,12,11/ImageMagick and 11/ImageMagick.
Comment 7 Petr Gajdos 2018-10-12 17:03:16 UTC
Packages submitted.
I believe all fixed.
Comment 12 Swamp Workflow Management 2018-10-17 10:12:25 UTC
SUSE-SU-2018:3191-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1098545,1098546,1110746,1110747,1111069,1111072
CVE References: CVE-2017-13058,CVE-2018-12599,CVE-2018-12600,CVE-2018-17965,CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.82.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.82.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.82.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.82.1
Comment 13 Swamp Workflow Management 2018-10-18 17:27:32 UTC
openSUSE-SU-2018:3225-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1098545,1098546,1110746,1110747,1111069,1111072
CVE References: CVE-2017-13058,CVE-2018-12599,CVE-2018-12600,CVE-2018-17965,CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-73.1
Comment 14 Swamp Workflow Management 2018-10-22 13:14:10 UTC
SUSE-SU-2018:3269-1: An update that fixes 12 vulnerabilities is now available.

Category: security (low)
Bug References: 1106855,1107604,1107609,1107612,1107616,1107619,1108282,1108283,1110746,1110747,1111069,1111072
CVE References: CVE-2018-16323,CVE-2018-16640,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,CVE-2018-16749,CVE-2018-16750,CVE-2018-17965,CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-78.72.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-78.72.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-78.72.1
Comment 17 Swamp Workflow Management 2018-10-23 19:19:51 UTC
SUSE-SU-2018:3348-1: An update that fixes 13 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1074170,1106855,1106989,1107604,1107609,1107612,1107616,1108282,1108283,1110746,1110747,1111069,1111072
CVE References: CVE-2017-17934,CVE-2018-16323,CVE-2018-16413,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,CVE-2018-16749,CVE-2018-16750,CVE-2018-17965,CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-78.74.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-78.74.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-78.74.1
Comment 18 Marcus Meissner 2018-10-26 06:40:12 UTC
released
Comment 20 Swamp Workflow Management 2018-11-13 14:12:10 UTC
SUSE-SU-2018:3753-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106254,1110746,1111069,1111072
CVE References: CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
SUSE Linux Enterprise Module for Development Tools 15 (src):    ImageMagick-7.0.7.34-3.34.3
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    ImageMagick-7.0.7.34-3.34.3
Comment 21 Swamp Workflow Management 2018-11-16 23:11:27 UTC
openSUSE-SU-2018:3797-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106254,1110746,1111069,1111072
CVE References: CVE-2018-17966,CVE-2018-18016,CVE-2018-18024
Sources used:
openSUSE Leap 15.0 (src):    ImageMagick-7.0.7.34-lp150.2.21.1
Comment 22 OBSbugzilla Bot 2021-10-04 16:42:06 UTC
This is an autogenerated message for OBS integration:
This bug (1111072) was mentioned in
https://build.opensuse.org/request/show/923064 Factory / ImageMagick