Bugzilla – Bug 1040304
VUL-1: CVE-2017-9142: GraphicsMagick,ImageMagick: missing checks in theReadOneJNGImage function in coders/png.c
Last modified: 2017-08-09 09:14:58 UTC
CVE-2017-9142 In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9142 http://www.cvedetails.com/cve/CVE-2017-9142/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9142 https://github.com/ImageMagick/ImageMagick/issues/490 https://github.com/ImageMagick/ImageMagick/commit/72f5c8632bff2daf3c95005f9b4cf2982786b52a
For all ImageMagick and GraphicsMagick versions: BEFORE $ convert assertion-failed-in-WriteBlob-blob5171 /dev/null convert: magick/blob.c:4072: WriteBlob: Assertion `data != (const unsigned char *) ((void *)0)' failed. Aborted (core dumped) $ AFTER $ convert assertion-failed-in-WriteBlob-blob5171 /dev/null 040304: corrupt image `assertion-failed-in-WriteBlob-blob5171' @ error/png.c/ReadOneJNGImage/4248. 040304: no images defined `/dev/null' @ error/convert.c/ConvertImageCommand/3149. $ For 11/GraphicsMagick, I get $ gm convert assertion-failed-in-WriteBlob-blob5171 /dev/null gm: magick/blob.c:739: CloseBlob: Assertion `image->signature == 0xabacadabUL' failed. $ which looks like another bug. If you feel it should be fixed, too, please reassign this bug to me back after the update is done.
I believe all fixed.
This is an autogenerated message for OBS integration: This bug (1040304) was mentioned in https://build.opensuse.org/request/show/500174 42.2 / GraphicsMagick
SUSE-SU-2017:1489-1: An update that fixes 27 vulnerabilities is now available. Category: security (moderate) Bug References: 1028075,1033091,1034870,1034872,1034876,1036976,1036977,1036978,1036980,1036981,1036982,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1036991,1037527,1038000,1040025,1040303,1040304,1040306,1040332 CVE References: CVE-2017-6502,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8343,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8347,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8356,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP2 (src): ImageMagick-6.8.8.1-70.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): ImageMagick-6.8.8.1-70.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): ImageMagick-6.8.8.1-70.1 SUSE Linux Enterprise Server 12-SP2 (src): ImageMagick-6.8.8.1-70.1 SUSE Linux Enterprise Desktop 12-SP2 (src): ImageMagick-6.8.8.1-70.1
openSUSE-SU-2017:1511-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1040304 CVE References: CVE-2017-9142 Sources used: openSUSE Leap 42.2 (src): GraphicsMagick-1.3.25-11.9.1
openSUSE-SU-2017:1560-1: An update that fixes 27 vulnerabilities is now available. Category: security (moderate) Bug References: 1028075,1033091,1034870,1034872,1034876,1036976,1036977,1036978,1036980,1036981,1036982,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1036991,1037527,1038000,1040025,1040303,1040304,1040306,1040332 CVE References: CVE-2017-6502,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8343,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8347,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8356,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144 Sources used: openSUSE Leap 42.2 (src): ImageMagick-6.8.8.1-30.3.1
SUSE-SU-2017:1599-1: An update that fixes 25 vulnerabilities is now available. Category: security (moderate) Bug References: 1033091,1034870,1034872,1034876,1036976,1036978,1036980,1036981,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1037527,1038000,1040025,1040303,1040304,1040306,1040332 CVE References: CVE-2014-9846,CVE-2016-10050,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): ImageMagick-6.4.3.6-7.77.1 SUSE Linux Enterprise Server 11-SP4 (src): ImageMagick-6.4.3.6-7.77.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): ImageMagick-6.4.3.6-7.77.1
SUSE-SU-2017:1600-1: An update that fixes 17 vulnerabilities is now available. Category: security (moderate) Bug References: 1033091,1034876,1036978,1036980,1036981,1036984,1036985,1036986,1036987,1036988,1036990,1037527,1038000,1040025,1040304,1040332,984144 CVE References: CVE-2014-9847,CVE-2017-7606,CVE-2017-7941,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8355,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9142,CVE-2017-9144 Sources used: SUSE Studio Onsite 1.3 (src): GraphicsMagick-1.2.5-4.77.1 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): GraphicsMagick-1.2.5-4.77.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): GraphicsMagick-1.2.5-4.77.1
release for Leap, closing
This bug is not present in GraphicsMagick 15108:19f1771574cc.