Bug 1062752 – VUL-0: CVE-2017-15218: GraphicsMagick,ImageMagick: memory leak in ReadOneJNGImage in coders/png.c

Bug 1062752 - (CVE-2017-15218) VUL-0: CVE-2017-15218: GraphicsMagick,ImageMagick: memory leak in ReadOneJNGImage in coders/png.c

(CVE-2017-15218)
Summary:	VUL-0: CVE-2017-15218: GraphicsMagick,ImageMagick: memory leak in ReadOneJNGI...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/193127/
Whiteboard:	CVSSv2:SUSE:CVE-2017-15218:5.0:(AV:N/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-10-11 11:00 UTC by Alexander Bergmann
Modified:	2018-02-12 08:41 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2017-10-11 11:00:21 UTC

CVE-2017-15218

ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.

Upstream fix:
https://github.com/ImageMagick/ImageMagick/commit/698c09d05a749664288281012f319cd51da664ee

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15218
https://github.com/ImageMagick/ImageMagick/issues/760

Comment 1 Petr Gajdos 2018-01-10 08:59:44 UTC

No testcase.

Comment 2 Petr Gajdos 2018-01-15 10:19:46 UTC

12/ImageMagick

Code is there, considering affected.

Comment 6 Petr Gajdos 2018-01-16 10:07:09 UTC

11/ImageMagick

Code is there, considering affected.

Comment 8 Petr Gajdos 2018-01-16 12:22:47 UTC

42.x/GraphicsMagick

Similar changes are part of the update patch, considering affected.

Comment 10 Swamp Workflow Management 2018-01-16 14:30:53 UTC

This is an autogenerated message for OBS integration:
This bug (1062752) was mentioned in
https://build.opensuse.org/request/show/566430 42.3 / GraphicsMagick

Comment 11 Swamp Workflow Management 2018-01-16 15:10:48 UTC

This is an autogenerated message for OBS integration:
This bug (1062752) was mentioned in
https://build.opensuse.org/request/show/566436 42.2 / GraphicsMagick

Comment 12 Petr Gajdos 2018-01-19 17:34:36 UTC

11/GraphicsMagick

Similar changes are part of the update patch, considering affected.

Comment 14 Petr Gajdos 2018-01-22 12:00:14 UTC

Submitted for: 12/ImageMagick, 11/ImageMagick, 11/GraphicsMagick and 42.x/GraphicsMagick

Comment 15 Petr Gajdos 2018-01-22 12:24:52 UTC

I believe all fixed.

Comment 16 Swamp Workflow Management 2018-01-25 20:09:42 UTC

openSUSE-SU-2018:0218-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1051442,1052708,1052717,1052777,1054600,1055374,1055455,1057000,1062752
CVE References: CVE-2017-11750,CVE-2017-12641,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-15218,CVE-2017-9261,CVE-2017-9262
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-60.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.63.1

Comment 17 Swamp Workflow Management 2018-02-02 14:12:12 UTC

SUSE-SU-2018:0349-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.33.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.33.1

Comment 18 Swamp Workflow Management 2018-02-02 14:17:26 UTC

SUSE-SU-2018:0350-1: An update that solves 30 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.29.2

Comment 19 Swamp Workflow Management 2018-02-08 11:15:57 UTC

openSUSE-SU-2018:0396-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1050037,1050072,1050098,1050100,1050635,1051442,1052470,1052708,1052717,1052721,1052768,1052777,1052781,1054600,1055068,1055374,1055455,1055456,1057000,1060162,1062752,1072362,1072901,1074120,1074125,1074185,1074309,1075939,1076021,1076051
CVE References: CVE-2017-10995,CVE-2017-11505,CVE-2017-11525,CVE-2017-11526,CVE-2017-11539,CVE-2017-11639,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12671,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13059,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14649,CVE-2017-15218,CVE-2017-17504,CVE-2017-17681,CVE-2017-17879,CVE-2017-17884,CVE-2017-17914,CVE-2017-18008,CVE-2017-18027,CVE-2017-18029,CVE-2017-9261,CVE-2017-9262,CVE-2018-5246,CVE-2018-5685
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-52.1

Comment 20 Swamp Workflow Management 2018-02-09 20:11:44 UTC

SUSE-SU-2018:0413-1: An update that fixes 34 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1043353,1043354,1047908,1047910,1050037,1050072,1050100,1051442,1052470,1052708,1052717,1052768,1052777,1052781,1054600,1055038,1055374,1055455,1055456,1057000,1060162,1062752,1067198,1073690,1074023,1074120,1074125,1074175,1075939
CVE References: CVE-2014-9811,CVE-2017-10995,CVE-2017-11102,CVE-2017-11505,CVE-2017-11526,CVE-2017-11539,CVE-2017-11750,CVE-2017-12565,CVE-2017-12640,CVE-2017-12641,CVE-2017-12643,CVE-2017-12673,CVE-2017-12676,CVE-2017-12935,CVE-2017-13065,CVE-2017-13141,CVE-2017-13142,CVE-2017-13147,CVE-2017-14103,CVE-2017-14174,CVE-2017-14649,CVE-2017-15218,CVE-2017-15238,CVE-2017-16669,CVE-2017-17501,CVE-2017-17504,CVE-2017-17782,CVE-2017-17879,CVE-2017-17884,CVE-2017-17915,CVE-2017-8352,CVE-2017-9261,CVE-2017-9262,CVE-2018-5685
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.33.1

Comment 21 Marcus Meissner 2018-02-12 08:41:18 UTC

released