CVE-2017-10794

When GraphicsMagick 1.3.25 processes an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode.

New stable upstream release including security fixes for CVE-2016-7800, CVE-2016-7996, CVE-2016-7997, CVE-2016-8682, CVE-2016-8683, CVE-2016-8684, CVE-2016-9830, CVE-2017-6335, CVE-2017-8350, CVE-2017-10794, CVE-2017-10799, CVE-2017-10800, CVE-2017-11403 and possibly several other security issues with and without associated CVE number.

These are all security issues fixed in the GraphicsMagick-1.3.36-1.7 package on the GA media of openSUSE Tumbleweed.

This update for GraphicsMagick fixes the following issues:

Security issues fixed:

• CVE-2018-18544: Fixed memory leak in the function WriteMSLImage() (bsc#1113064).
• CVE-2017-10794: Fixed buffer overflow in RGB TIFF picture processing (bsc#1112392).
• CVE-2017-14997: Fixed integer underflow in ReadPICTImage in coders/pict.c (bsc#1112399).
• CVE-2018-20185: Fixed heap-based buffer over-read in the ReadBMPImage function of bmp.c (bsc#1119823)
• CVE-2018-20184: Fixed heap-based buffer overflow in the WriteTGAImage function of tga.c (bsc#1119822)

Regressions fixed after security update:

• CVE-2017-12663: Fixed memory leak in WriteMAPImage in coders/map.c (bsc#1052754).
• CVE-2017-9405: Fixed memory leak in the ReadICONImage function (bsc#1042911).
• CVE-2018-6405: Fixed ReadDCMImage function in coders/dcm (bsc#1078433).

Non-security issues fixed:

• debug_build: build more suitable for debugging

It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-10794, CVE-2017-10799, CVE-2017-11102, CVE-2017-11140, CVE-2017-11403, CVE-2017-11636, CVE-2017-11637, CVE-2017-13147, CVE-2017-14042, CVE-2017-6335)