[ubuntu/xenial-security] graphicsmagick 1.3.23-1ubuntu0.4 (Accepted)

[Eduardo dos Santos Barretto]

graphicsmagick (1.3.23-1ubuntu0.4) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS (memory consumption) on ReadSUNImage()
    - debian/patches/CVE-2017-14165.patch: Verify that file header data length,
      and file length are sufficient for claimed image dimensions.
    - CVE-2017-14165
  * SECURITY UPDATE: Heap-based buffer over-read in DrawImage()
    - debian/patches/CVE-2017-14314.patch: Fix heap out of bounds read in
      DrawDashPolygon().
    - CVE-2017-14314
  * SECURITY UPDATE: Null pointer dereference in ReadPNMImage()
    - debian/patches/CVE-2017-14504.patch: Require that XV 332 format have 256
      colors.
    - CVE-2017-14504
  * SECURITY UPDATE: DoS (crash) assertion failure in magick/pixel_cache.c
    - debian/patches/CVE-2017-14649.patch: Validate JNG data properly.
    - CVE-2017-14649
  * SECURITY UPDATE: Heap-based buffer over-read in ReadRLEImage()
    - debian/patches/CVE-2017-14733.patch: Fully rationalize Ncolors when Alpha
      flag is present.
    - CVE-2017-14733
  * SECURITY UPDATE: Null pointer dereference in ReadDCMImage()
    - debian/patches/CVE-2017-14994.patch: DCM_ReadNonNativeImages() can produce
      image list with no frames, resulting in null image pointer.
    - CVE-2017-14994
  * SECURITY UPDATE: Integer underflow in ReadPICTImage()
    - debian/patches/CVE-2017-14997.patch: Avoid unsigned underflow leading to
      astonishingly large allocation request.
    - CVE-2017-14997
  * SECURITY UPDATE: Resource leak in ReadGIFImage()
    - debian/patches/CVE-2017-15277.patch: Assure that global colormap is fully
      initialized.
    - CVE-2017-15277
  * SECURITY UPDATE: Null pointer dereference in ReadOneJNGImage()
    - debian/patches/CVE-2017-15930-1.patch: Fix possible use of NULL pointer
      when transferring JPEG scanlines.
    - debian/patches/CVE-2017-15930-2.patch: Add more checks for use of null
      PixelPacket pointer.
    - debian/patches/CVE-2017-15930-3.patch: Reject JNG files with unreasonable
      dimensions given the file size.
    - debian/patches/CVE-2017-15930-4.patch: Ensure that reasonable exception
      gets reported on read failure.
    - CVE-2017-15930
  * SECURITY UPDATE: Heap-based buffer overflow in DescribeImage()
    - debian/patches/CVE-2017-16352.patch: Fix possible heap write overflow
      while describing visual image directory.
    - CVE-2017-16352
  * SECURITY UPDATE: Memory information disclosure in DescribeImage()
    - debian/patches/CVE-2017-16353.patch: Fix weaknesses while describing the
      IPTC profile.
    - CVE-2017-16353

Date: 2020-01-08 15:20:39.828370+00:00
Changed-By: Eduardo dos Santos Barretto <eduardo.barretto at canonical.com>
https://launchpad.net/ubuntu/+source/graphicsmagick/1.3.23-1ubuntu0.4
-------------- next part --------------
Sorry, changesfile not available.