-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2672-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Anton Gladky June 02, 2021 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : imagemagick Version : 8:6.9.7.4+dfsg-11+deb9u13 CVE ID : CVE-2020-27751 CVE-2021-20243 CVE-2021-20245 CVE-2021-20309 CVE-2021-20312 CVE-2021-20313 Multiple security issues have been discovered in imagemagick. CVE-2020-27751 A flaw was found in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. CVE-2021-20243 A flaw was found in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. CVE-2021-20245 A flaw was found in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. CVE-2021-20309 A division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. CVE-2021-20312 An integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. CVE-2021-20313 A potential cipher leak when the calculate signatures in TransformSignature is possible. For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u13. We recommend that you upgrade your imagemagick packages. For the detailed security status of imagemagick please refer to its security tracker page at: https://security-tracker.debian.org/tracker/imagemagick Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmC4YaYACgkQ0+Fzg8+n /wYMuw//ZsXNvwxPZRk252ZwNcHveR/+5dRe93CB+WSGBbUqaTSfQzvqM9DLQxZi G9D2srgZK+yg1kev4Wa3FufpEjJkE3YFWLvEjhBhqAuj+Px1y/K3YNaRhPw1xC0o z7GIyoLWi3jAsyyZnOJupUfPpo+ac6yFcT1eAYGMS2hLS6WDx/32l+YBflYKWja0 eqIWfgXwxSA6uaTjV4SNc6JP1VqoA44ZJE7sS9R9oYhR5ewkQ+rDIDfAHyOG/gk/ EG0UwbZZWlpVsPzvEHZxanr2A2+GvJZ3AQ1hirlbWyGcf4Jv4uJ/Xw8jdH7rG1EE VgqEFHGRVznAQXmbGDPvoREMgSQiYd0yWYs0yVqUGT0Asp5nyr+1bDna8irG5cok 1Ubg+u6YquUa2PPbmWp7zK6+7o4A6PW48mAt29YwIM8vrZE4AV3fW6a4XXWEeuTB wu3ljrhmYPmm9hO9eG8RrK8810+wDCnTeX9lXI2pDF/9dcllXku/ArtXR+e0Ejxv xESCkYOjVEY7MCVwuNvVZE197LAXqctUQ7aoTpixnulmTpmmx9OG0Wg8DbQhS1cI XFJXBL9tmYuN2dwzk7R8trOtZWl2rDzHbxPXR3EFO/fU+cjCMRMfKt90Ed6bKmfd 4v6AXVWZXSow02IDi5Nud+L6FAQZ9ZkjLjOK9Updboe7MoIIy2A= =e6iK -----END PGP SIGNATURE-----