Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.SUSE_SU-2019-1033-1.NASL
HistoryApr 26, 2019 - 12:00 a.m.

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2019:1033-1)

2019-04-2600:00:00
This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
22

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.021 Low

EPSS

Percentile

89.4%

JSON

This update for ImageMagick fixes the following issues :

Security issues fixed :

CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330).

CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317).

CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649).

CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381).

CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365).

CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366).

CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel (bsc#1124368).

CVE-2018-16413: Fixed a heap-based buffer over-read in PushShortPixel() (bsc#1106989).

CVE-2018-16412: Fixed a heap-based buffer over-read in ParseImageResourceBlocks() (bsc#1106996).

CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609).

CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060).

CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage() (bsc#1132054).

CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053).

Added extra -config- packages with Postscript/EPS/PDF readers still enabled.

Removing the PS decoders is used to harden ImageMagick against security issues within ghostscript. Enabling them might impact security. (bsc#1122033)

These are two packages that can be selected :

  • ImageMagick-config-6-SUSE: This has the PS decoders disabled.

  • ImageMagick-config-6-upstream: This has the PS decoders enabled.

    Depending on your local needs install either one of them. The default is the -SUSE configuration.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:1033-1.
# The text itself is copyright (C) SUSE.
#

include('compat.inc');

if (description)
{
  script_id(124315);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/31");

  script_cve_id(
    "CVE-2018-16412",
    "CVE-2018-16413",
    "CVE-2018-16644",
    "CVE-2018-20467",
    "CVE-2019-10650",
    "CVE-2019-11007",
    "CVE-2019-11008",
    "CVE-2019-11009",
    "CVE-2019-7175",
    "CVE-2019-7395",
    "CVE-2019-7397",
    "CVE-2019-7398",
    "CVE-2019-9956"
  );

  script_name(english:"SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2019:1033-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"This update for ImageMagick fixes the following issues :

Security issues fixed :

CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel()
(bsc#1130330).

CVE-2019-10650: Fixed a heap-based buffer over-read in
WriteTIFFImage() (bsc#1131317).

CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function
(bsc#1128649).

CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381).

CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage
(bsc#1124365).

CVE-2019-7397: Fixed a memory leak in the function WritePDFImage
(bsc#1124366).

CVE-2019-7395: Fixed a memory leak in the function WritePSDChannel
(bsc#1124368).

CVE-2018-16413: Fixed a heap-based buffer over-read in
PushShortPixel() (bsc#1106989).

CVE-2018-16412: Fixed a heap-based buffer over-read in
ParseImageResourceBlocks() (bsc#1106996).

CVE-2018-16644: Fixed a regression in dcm coder (bsc#1107609).

CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage()
(bsc#1132060).

CVE-2019-11008: Fixed a heap-based buffer overflow in WriteXWDImage()
(bsc#1132054).

CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage()
(bsc#1132053).

Added extra -config- packages with Postscript/EPS/PDF readers still
enabled.

Removing the PS decoders is used to harden ImageMagick against
security issues within ghostscript. Enabling them might impact
security. (bsc#1122033)

These are two packages that can be selected :

  - ImageMagick-config-6-SUSE: This has the PS decoders
    disabled.

  - ImageMagick-config-6-upstream: This has the PS decoders
    enabled.

    Depending on your local needs install either one of
    them. The default is the -SUSE configuration.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1106989");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1106996");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1107609");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1120381");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1122033");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1124365");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1124366");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1124368");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1128649");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1130330");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1131317");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1132053");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1132054");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1132060");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-16412/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-16413/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-16644/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20467/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-10650/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-11007/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-11008/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-11009/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-7175/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-7395/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-7397/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-7398/");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9956/");
  # https://www.suse.com/support/update/announcement/2019/suse-su-20191033-1/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3240807e");
  script_set_attribute(attribute:"solution", value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch
SUSE-OpenStack-Cloud-7-2019-1033=1

SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch
SUSE-SLE-WE-12-SP4-2019-1033=1

SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch
SUSE-SLE-WE-12-SP3-2019-1033=1

SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
patch SUSE-SLE-SDK-12-SP4-2019-1033=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2019-1033=1

SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
SUSE-SLE-SAP-12-SP2-2019-1033=1

SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
SUSE-SLE-SERVER-12-SP4-2019-1033=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2019-1033=1

SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2019-1033=1

SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-BCL-2019-1033=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2019-1033=1

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2019-1033=1

SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP4-2019-1033=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2019-1033=1

SUSE Enterprise Storage 4:zypper in -t patch
SUSE-Storage-4-2019-1033=1");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9956");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/04/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-6-SUSE");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-config-6-upstream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ImageMagick-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagick++-6_Q16-3-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16-1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickCore-6_Q16-1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-6_Q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libMagickWand-6_Q16-1-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(0|1|2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0/1/2/3/4", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"4", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagick++-6_Q16-3-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-config-6-SUSE-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-config-6-upstream-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"ImageMagick-debugsource-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagick++-6_Q16-3-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-6.8.8.1-71.108.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.108.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick");
}
VendorProductVersionCPE
novellsuse_linuximagemagick-config-6-upstreamp-cpe:/a:novell:suse_linux:imagemagick-config-6-upstream
novellsuse_linuximagemagick-debuginfop-cpe:/a:novell:suse_linux:imagemagick-debuginfo
novellsuse_linuxlibmagickcore-6_q16p-cpe:/a:novell:suse_linux:libmagickcore-6_q16
novellsuse_linux12cpe:/o:novell:suse_linux:12
novellsuse_linuxlibmagickcore-6_q16-1p-cpe:/a:novell:suse_linux:libmagickcore-6_q16-1
novellsuse_linuxlibmagickwand-6_q16-1-debuginfop-cpe:/a:novell:suse_linux:libmagickwand-6_q16-1-debuginfo
novellsuse_linuxlibmagick%2b%2b-6_q16p-cpe:/a:novell:suse_linux:libmagick%2b%2b-6_q16
novellsuse_linuxlibmagickwand-6_q16p-cpe:/a:novell:suse_linux:libmagickwand-6_q16
novellsuse_linuxlibmagickcore-6_q16-1-debuginfop-cpe:/a:novell:suse_linux:libmagickcore-6_q16-1-debuginfo
novellsuse_linuximagemagick-config-6-susep-cpe:/a:novell:suse_linux:imagemagick-config-6-suse
Rows per page:
1-10 of 131

References

Related

nessus 25
suse 9
openvas 29
mageia 2
ubuntucve 14
osv 11
debian 4
freebsd 1
prion 15
debiancve 13
cvelist 14
nvd 14
cve 15
alpinelinux 12
redhatcve 10
cloudfoundry 1
ubuntu 1
veracode 8
archlinux 1
nessus
nessus
openSUSE Security Update : ImageMagick (openSUSE-2019-1320)
2019-05-06 00:00:00
SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2019:13993-1)
2019-03-28 00:00:00
openSUSE Security Update : ImageMagick (openSUSE-2019-1331)
2019-05-06 00:00:00
suse
suse
Security update for ImageMagick (moderate)
2019-05-03 00:00:00
Security update for ImageMagick (moderate)
2019-05-04 00:00:00
Security update for ImageMagick (moderate)
2019-04-05 00:00:00
openvas
openvas
openSUSE: Security Advisory for ImageMagick (openSUSE-SU-2019:1320-1)
2019-05-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:1033-1)
2021-04-19 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:13993-1)
2021-06-09 00:00:00
mageia
mageia
Updated imagemagick packages fix security vulnerabilities
2019-06-10 22:17:03
Updated ImageMagick/GraphicsMagick packages fix security vulnerability
2019-03-21 19:36:46
ubuntucve
ubuntucve
CVE-2018-16413
2018-09-03 00:00:00
CVE-2019-11473
2019-04-23 00:00:00
CVE-2019-11474
2019-04-23 00:00:00
osv
osv
imagemagick - security update
2019-04-28 00:00:00
imagemagick - security update
2018-10-12 00:00:00
graphicsmagick - security update
2019-04-13 00:00:00
debian
debian
[SECURITY] [DSA 4436-1] imagemagick security update
2019-04-28 19:46:11
[SECURITY] [DSA 4316-1] imagemagick security update
2018-10-12 20:55:21
[SECURITY] [DLA 1755-1] graphicsmagick security update
2019-04-13 22:13:02
freebsd
freebsd
ImageMagick -- multiple vulnerabilities
2019-03-07 00:00:00
prion
prion
Design/Logic Flaw
2019-04-23 14:29:00
Out-of-bounds
2019-04-23 14:29:00
Heap overflow
2019-04-08 19:29:00
debiancve
debiancve
CVE-2019-11474
2019-04-23 14:29:01
CVE-2019-11473
2019-04-23 14:29:00
CVE-2018-16412
2018-09-03 19:29:01
cvelist
cvelist
CVE-2019-11474
2019-04-23 13:55:39
CVE-2019-11473
2019-04-23 13:55:28
CVE-2019-11007
2019-04-08 18:18:08
nvd
nvd
CVE-2019-11474
2019-04-23 14:29:01
CVE-2019-11473
2019-04-23 14:29:00
CVE-2019-11009
2019-04-08 19:29:05
cve
cve
CVE-2019-11474
2019-04-23 14:29:01
CVE-2019-11473
2019-04-23 14:29:00
CVE-2019-11007
2019-04-08 19:29:05
alpinelinux
alpinelinux
CVE-2019-11473
2019-04-23 14:29:00
CVE-2019-11474
2019-04-23 14:29:01
CVE-2018-16412
2018-09-03 19:29:01
redhatcve
redhatcve
CVE-2019-11473
2022-05-20 22:46:50
CVE-2018-16412
2018-09-04 22:19:02
CVE-2019-7395
2019-02-05 11:21:01
cloudfoundry
cloudfoundry
USN-4034-1: ImageMagick vulnerabilities | Cloud Foundry
2019-07-10 00:00:00
ubuntu
ubuntu
ImageMagick vulnerabilities
2019-06-25 00:00:00
veracode
veracode
Denial Of Service (DoS)
2020-12-06 04:40:09
Denial Of Service (DoS)
2018-12-26 08:21:28
Memory Leak
2019-02-07 09:41:10
archlinux
archlinux
[ASA-201903-15] imagemagick: arbitrary code execution
2019-03-28 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.021 Low

EPSS

Percentile

89.4%

JSON
Related for SUSE_SU-2019-1033-1.NASL
nessus25suse9openvas29mageia2ubuntucve14osv11debian4freebsd1prion15debiancve13cvelist14nvd14cve15alpinelinux12redhatcve10cloudfoundry1ubuntu1veracode8archlinux1