Mageia alert MGASA-2024-0064 (imagemagick)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2024-0064: Updated imagemagick packages fix security vulnerabilities
Date:
             
 
Fri, 15 Mar 2024 23:52:52 +0100
Message-ID:
             
 
<20240315225252.8E3629FD40@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2024-0064 - Updated imagemagick packages fix security vulnerabilities

Publication date: 15 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0064.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2021-3610,
     CVE-2023-3195,
     CVE-2023-3428,
     CVE-2023-34151

Description:
The updated packages fix security vulnerabilities:
A heap-based buffer overflow vulnerability was found in ImageMagick in
versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This
issue is due to an incorrect setting of the pixel array size, which can
lead to a crash and segmentation fault. (CVE-2021-3610)
A stack-based buffer overflow issue was found in ImageMagick's
coders/tiff.c. This flaw allows an attacker to trick the user into
opening a specially crafted malicious tiff file, causing an application
to crash, resulting in a denial of service. (CVE-2023-3195)
A heap-based buffer overflow vulnerability was found in coders/tiff.c in
ImageMagick. This issue may allow a local attacker to trick the user
into opening a specially crafted file, resulting in an application crash
and denial of service. (CVE-2023-3428)
This security flaw ouccers as an undefined behaviors of casting double
to size_t in svg, mvg and other coders (recurring bugs of
CVE-2022-32546). (CVE-2023-34151)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32076
- https://ubuntu.com/security/notices/USN-6200-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3610
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3195
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3428
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3...

SRPMS:
- 9/core/imagemagick-7.1.1.29-1.mga9
- 9/tainted/imagemagick-7.1.1.29-1.mga9.tainted