CVE-2016-2317

Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.

Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.

• A read out-of-bound in the parsing of gif files using GraphicsMagick (CVE-2015-8808).

• Infinite loop caused by converting a circularly defined svg file (CVE-2016-5240).

• Fix another case of CVE-2016-2317 (heap buffer overflow) in the MVG rendering code (also impacts SVG).

• arithmetic exception converting a svg file (CVE-2016-5241)

• Arithmetic exception converting a svg file caused by a X%0 operation in magick/render.c (CVE-2016-2318)

• A shell exploit (CVE-2016-5118) was discovered associated with a filename syntax where file names starting with '|' are intepreted as shell commands executed via popen(). Insufficient sanitization in the SVG and MVG renderers allows such filenames to be passed through from potentially untrusted files. There might be other ways for untrusted inputs to produce such filenames. Due to this issue, support for the feature is removed entirely.

The gnudl, octave, pdf2djvu, and photoqt packages have been rebuilt to use the updated GraphicsMagick++ library.

These are all security issues fixed in the GraphicsMagick-1.3.25-1.1 package on the GA media of openSUSE Tumbleweed.

GraphicsMagick was updated to fix 37 security issues.

These security issues were fixed:

• CVE-2014-9810: SEGV in dpx file handler (bsc#983803).
• CVE-2014-9811: Crash in xwd file handler (bsc#984032).
• CVE-2014-9813: Crash on corrupted viff file (bsc#984035).
• CVE-2014-9814: NULL pointer dereference in wpg file handling (bsc#984193).
• CVE-2014-9815: Crash on corrupted wpg file (bsc#984372).
• CVE-2014-9816: Out of bound access in viff image (bsc#984398).
• CVE-2014-9817: Heap buffer overflow in pdb file handling (bsc#984400).
• CVE-2014-9818: Out of bound access on malformed sun file (bsc#984181).
• CVE-2014-9819: Heap overflow in palm files (bsc#984142).
• CVE-2014-9830: Handling of corrupted sun file (bsc#984135).
• CVE-2014-9831: Handling of corrupted wpg file (bsc#984375).
• CVE-2014-9837: Additional PNM sanity checks (bsc#984166).
• CVE-2014-9834: Heap overflow in pict file (bsc#984436).
• CVE-2014-9853: Memory leak in rle file handling (bsc#984408).
• CVE-2015-8903: Denial of service (cpu) in vicar (bsc#983259).
• CVE-2015-8901: MIFF file DoS (endless loop) (bsc#983234).
• CVE-2016-5688: Various invalid memory reads in ImageMagick WPG (bsc#985442).
• CVE-2015-8894: Double free in coders/tga.c:221 (bsc#983523).
• CVE-2015-8896: Double free / integer truncation issue in coders/pict.c:2000 (bsc#983533).
• CVE-2014-9807: Double free in pdb coder. (bsc#983794).
• CVE-2014-9828: Corrupted (too many colors) psd file (bsc#984028).
• CVE-2014-9805: SEGV due to a corrupted pnm file (bsc#983752).
• CVE-2014-9808: SEGV due to corrupted dpc images (bsc#983796).
• CVE-2014-9820: Heap overflow in xpm files (bsc#984150).
• CVE-2014-9839: Theoretical out of bound access in magick/colormap-private.h (bsc#984379).
• CVE-2014-9809: SEGV due to corrupted xwd images. (bsc#983799).
• CVE-2016-5240: SVG converting issue resulting in DoS (endless loop) (bsc#983309).
• CVE-2014-9840: Out of bound access in palm file (bsc#984433).
• CVE-2014-9847: Incorrect handling of 'previous' image in the JNG decoder (bsc#984144).
• CVE-2016-5241: Arithmetic exception (div by 0) in SVG conversion (bsc#983455).
• CVE-2014-9845: Crash due to corrupted dib file (bsc#984394).
• CVE-2014-9844: Out of bound issue in rle file (bsc#984373).
• CVE-2014-9835: Heap overflow in wpf file (bsc#984145).
• CVE-2014-9829: Out of bound access in sun file (bsc#984409).
• CVE-2014-9846: Added checks to prevent overflow in rle file. (bsc#983521).
• CVE-2016-2317: Multiple vulnerabilities when parsing and processing SVG files (bsc#965853).
• CVE-2016-2318: Multiple vulnerabilities when parsing and processing SVG files (bsc#965853).