[SECURITY] [DLA 547-2] graphicsmagick regression update

2017-03-2820:35:50

lists.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

8.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.0%

JSON

Package : graphicsmagick
Version : 1.3.16-1.1+deb7u6
CVE ID : CVE-2016-5240
Debian Bug : N/A

The fix for CVE-2016-5240 was improperly applied which resulted in
GraphicsMagick crashing instead of entering an infinite loop with the
given proof of concept.

Furthermore, the original announcement mistakently used the identifier
"DLA 574-1" instead of the correct one, "DLA 547-1".

For Debian 7 "Wheezy", these problems have been fixed in version
1.3.16-1.1+deb7u6.

We recommend that you upgrade your graphicsmagick packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian8arm64libgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_arm64.deb
Debian7armelgraphicsmagick-dbg< 1.3.16-1.1+deb7u3graphicsmagick-dbg_1.3.16-1.1+deb7u3_armel.deb
Debian7armellibgraphicsmagick3< 1.3.16-1.1+deb7u3libgraphicsmagick3_1.3.16-1.1+deb7u3_armel.deb
Debian8kfreebsd-i386libgraphics-magick-perl< 1.3.20-3+deb8u2libgraphics-magick-perl_1.3.20-3+deb8u2_kfreebsd-i386.deb
Debian8amd64graphicsmagick< 1.3.20-3+deb8u2graphicsmagick_1.3.20-3+deb8u2_amd64.deb
Debian8armellibgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_armel.deb
Debian8mipsellibgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_mipsel.deb
Debian8mipslibgraphicsmagick3< 1.3.20-3+deb8u2libgraphicsmagick3_1.3.20-3+deb8u2_mips.deb
Debian7armhflibgraphicsmagick3< 1.3.16-1.1+deb7u6libgraphicsmagick3_1.3.16-1.1+deb7u6_armhf.deb
Debian8ppc64ellibgraphics-magick-perl< 1.3.20-3+deb8u2libgraphics-magick-perl_1.3.20-3+deb8u2_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	arm64	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_arm64.deb
Debian	7	armel	graphicsmagick-dbg	< 1.3.16-1.1+deb7u3	graphicsmagick-dbg_1.3.16-1.1+deb7u3_armel.deb
Debian	7	armel	libgraphicsmagick3	< 1.3.16-1.1+deb7u3	libgraphicsmagick3_1.3.16-1.1+deb7u3_armel.deb
Debian	8	kfreebsd-i386	libgraphics-magick-perl	< 1.3.20-3+deb8u2	libgraphics-magick-perl_1.3.20-3+deb8u2_kfreebsd-i386.deb
Debian	8	amd64	graphicsmagick	< 1.3.20-3+deb8u2	graphicsmagick_1.3.20-3+deb8u2_amd64.deb
Debian	8	armel	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_armel.deb
Debian	8	mipsel	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_mipsel.deb
Debian	8	mips	libgraphicsmagick3	< 1.3.20-3+deb8u2	libgraphicsmagick3_1.3.20-3+deb8u2_mips.deb
Debian	7	armhf	libgraphicsmagick3	< 1.3.16-1.1+deb7u6	libgraphicsmagick3_1.3.16-1.1+deb7u6_armhf.deb
Debian	8	ppc64el	libgraphics-magick-perl	< 1.3.20-3+deb8u2	libgraphics-magick-perl_1.3.20-3+deb8u2_ppc64el.deb