[SECURITY] [DLA 502-1] graphicsmagick security update

2016-06-0209:05:10

lists.debian.org

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.652 Medium

EPSS

Percentile

97.9%

JSON

Package : graphicsmagick
Version : 1.3.16-1.1+deb7u2
CVE ID : CVE-2016-5118
Debian Bug : 825800

Bob Friesenhahn discovered a command injection vulnerability in
Graphicsmagick, a program suite for image manipulation. An attacker with
control on input image or the input filename can execute arbitrary
commands with the privileges of the user running the application.

This update removes the possibility of using pipe (|) in filenames to
interact with graphicsmagick.

For Debian 7 "Wheezy", these problems have been fixed in version
1.3.16-1.1+deb7u2.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8ppc64ellibmagick++-6.q16-dev< 8:6.8.9.9-5+deb8u3libmagick++-6.q16-dev_8:6.8.9.9-5+deb8u3_ppc64el.deb
Debian8arm64libmagickwand-6.q16-2< 8:6.8.9.9-5+deb8u3libmagickwand-6.q16-2_8:6.8.9.9-5+deb8u3_arm64.deb
Debian8armellibgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_armel.deb
Debian8mipsellibgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_mipsel.deb
Debian8armellibmagick++-6.q16-dev< 8:6.8.9.9-5+deb8u3libmagick++-6.q16-dev_8:6.8.9.9-5+deb8u3_armel.deb
Debian7armellibmagickwand5< 8:6.7.7.10-5+deb7u6libmagickwand5_8:6.7.7.10-5+deb7u6_armel.deb
Debian7i386libgraphicsmagick++1-dev< 1.3.16-1.1+deb7u2libgraphicsmagick++1-dev_1.3.16-1.1+deb7u2_i386.deb
Debian7armhflibmagickcore5< 8:6.7.7.10-5+deb7u6libmagickcore5_8:6.7.7.10-5+deb7u6_armhf.deb
Debian7amd64libmagickcore5-extra< 8:6.7.7.10-5+deb7u6libmagickcore5-extra_8:6.7.7.10-5+deb7u6_amd64.deb
Debian7armellibgraphicsmagick1-dev< 1.3.16-1.1+deb7u2libgraphicsmagick1-dev_1.3.16-1.1+deb7u2_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	ppc64el	libmagick++-6.q16-dev	< 8:6.8.9.9-5+deb8u3	libmagick++-6.q16-dev_8:6.8.9.9-5+deb8u3_ppc64el.deb
Debian	8	arm64	libmagickwand-6.q16-2	< 8:6.8.9.9-5+deb8u3	libmagickwand-6.q16-2_8:6.8.9.9-5+deb8u3_arm64.deb
Debian	8	armel	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_armel.deb
Debian	8	mipsel	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_mipsel.deb
Debian	8	armel	libmagick++-6.q16-dev	< 8:6.8.9.9-5+deb8u3	libmagick++-6.q16-dev_8:6.8.9.9-5+deb8u3_armel.deb
Debian	7	armel	libmagickwand5	< 8:6.7.7.10-5+deb7u6	libmagickwand5_8:6.7.7.10-5+deb7u6_armel.deb
Debian	7	i386	libgraphicsmagick++1-dev	< 1.3.16-1.1+deb7u2	libgraphicsmagick++1-dev_1.3.16-1.1+deb7u2_i386.deb
Debian	7	armhf	libmagickcore5	< 8:6.7.7.10-5+deb7u6	libmagickcore5_8:6.7.7.10-5+deb7u6_armhf.deb
Debian	7	amd64	libmagickcore5-extra	< 8:6.7.7.10-5+deb7u6	libmagickcore5-extra_8:6.7.7.10-5+deb7u6_amd64.deb
Debian	7	armel	libgraphicsmagick1-dev	< 1.3.16-1.1+deb7u2	libgraphicsmagick1-dev_1.3.16-1.1+deb7u2_armel.deb