Security Bulletin: Multiple vulnerabilities in ImageMagick affect PowerKVM

Summary

PowerKVM is affected by several vulnerabilities in ImageMagick. These vulnerabilities are now fixed.

Vulnerability Details

CVEID: CVE-2015-8895**
DESCRIPTION:** ImageMagick is vulnerable to a buffer overflow, caused by improper bounds checking by multiple integer overflows in coders/icon.c. By sending an overly long argument, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114226 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVEID: CVE-2015-8896**
DESCRIPTION:** ImageMagick is vulnerable to a heap-based buffer overflow, caused by an integer truncation in coders/pict.c. By persuading a victim to open a specially crafted image file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114227 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-8897**
DESCRIPTION:** ImageMagick is vulnerable to a denial of service, caused by an out-of-bounds error in SpliceImage. By persuading a victim to open a specially crafted image file, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114228 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8898**
DESCRIPTION:** ImageMagick is vulnerable to a denial of service, caused by a NULL pointer dereference in magick/constitute.c. By persuading a victim to open a specially crafted image file, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114229 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-5118**
DESCRIPTION:** ImageMagick and GraphicsMagick could allow a remote attacker to execute arbitrary commands on the system, caused by an error in popen() file open feature. By processing a specially-crafted filename string, an attacker could exploit this vulnerability to execute arbitrary shell commands on the system with elevated privileges.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113611 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-5239**
DESCRIPTION:** ImageMagick could allow a remote attacker to execute arbitrary commands on the system, caused by the improper validation of input prior to passing it to the gnuplot delegate functionality… By persuading a victim to open a specially crafted image, an attacker could exploit this vulnerability to inject and execute arbitrary shell commands on the system.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114230 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-5240**
DESCRIPTION:** ImageMagick is vulnerable to a denial of service. By persuading a victim to convert a circularly defined svg file, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114231 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

PowerKVM v2.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

PowerKVM version 3.1 is not affected by these vulnerabilities.

For version 2.1, see PowerKVM 2.1.1.3-65. Update 10 at https://ibm.biz/BdEnT8 or later. Customers running v2.1 are, in any case, encouraged to upgrade to v3.1.

For v2.1 systems currently running fix levels of PowerKVM prior to 2.1.1, please see <http://download4.boulder.ibm.com/sar/CMA/OSA/05e4c/0/README&gt; for prerequisite fixes and instructions.

Workarounds and Mitigations

None