CVE-2016-9556

The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

The imagemagick package has been updated to version 6.9.9.41 which fixes several unspecified security vulnerabilities. This update fixes several vulnerabilities in imagemagick, including: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files are processed.

Several packages have been rebuilt for the updated ImageMagick.

This update for ImageMagick fixes the following issues:

• CVE-2016-9556: Possible Heap-overflow found by fuzzing [bsc#1011130]
• CVE-2016-9559: Possible Null pointer access found by fuzzing [bsc#1011136]
• CVE-2016-8707: Possible code execution in the tiff deflate convert code [bsc#1014159]
• CVE-2016-9773: Possible Heap overflow in IsPixelGray [bsc#1013376]
• CVE-2016-8866: Possible memory allocation failure in AcquireMagickMemory [bsc#1009318]

This update for ImageMagick fixes the following issues:

• CVE-2016-9556 Possible Heap-overflow found by fuzzing [bsc#1011130]
• CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136]
• CVE-2016-8707 Possible code execution in Tiff conver utility [bsc#1014159]
• CVE-2016-8866 Memory allocation failure in AcquireMagickMemory could lead to Heap overflow [bsc#1009318]
• CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136]

This update for GraphicsMagick fixes the following issues:

• CVE-2016-9556 Possible Heap-overflow found by fuzzing [bsc#1011130]
• CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136]
• CVE-2016-8866 Possible memory allocation failure in AcquireMagickMemory [bsc#1009318]
• CVE-2016-9830: Memory allocation failure in MagickRealloc (memory.c) (bsc#1013640).

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.