[Tech ARP] The First AMD Radeon Instinct Servers Revealed!

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256

 

- -------------------------------------------------------------------------

Debian Security Advisory DSA-3746-1 security ( -at -) debian.org

https://www.debian.org/security/ Luciano Bello

December 24, 2016 https://www.debian.org/security/faq

- -------------------------------------------------------------------------

 

Package : graphicsmagick

CVE ID : CVE-2015-8808 CVE-2016-2317 CVE-2016-2318 CVE-2016-3714

CVE-2016-3715 CVE-2016-5118 CVE-2016-5240 CVE-2016-7800

CVE-2016-7996 CVE-2016-7997 CVE-2016-8682 CVE-2016-8683

CVE-2016-8684 CVE-2016-9830

Debian Bug : 814732 825800 847055

 

Several vulnerabilities have been discovered in GraphicsMagick, a

collection of image processing tool, which can cause denial of service

attacks, remote file deletion, and remote command execution.

 

This security update removes the full support of PLT/Gnuplot decoder to

prevent Gnuplot-shell based shell exploits for fixing the CVE-2016-3714

vulnerability.

 

The undocumented "TMP" magick prefix no longer removes the argument file

after it has been read for fixing the CVE-2016-3715 vulnerability. Since

the "TMP" feature was originally implemented, GraphicsMagick added a

temporary file management subsystem which assures that temporary files

are removed so this feature is not needed.

 

Remove support for reading input from a shell command, or writing output

to a shell command, by prefixing the specified filename (containing the

command) with a '|' for fixing the CVE-2016-5118 vulnerability.

 

CVE-2015-8808

 

Gustavo Grieco discovered an out of bound read in the parsing of GIF

files which may cause denial of service.

 

CVE-2016-2317

 

Gustavo Grieco discovered a stack buffer overflow and two heap buffer

overflows while processing SVG images which may cause denial of service.

 

CVE-2016-2318

 

Gustavo Grieco discovered several segmentation faults while processing

SVG images which may cause denial of service.

 

CVE-2016-5240

 

Gustavo Grieco discovered an endless loop problem caused by negative

stroke-dasharray arguments while parsing SVG files which may cause

denial of service.

 

CVE-2016-7800

 

Marco Grassi discovered an unsigned underflow leading to heap overflow

when parsing 8BIM chunk often attached to JPG files which may cause

denial of service.

 

CVE-2016-7996

 

Moshe Kaplan discovered that there is no check that the provided

colormap is not larger than 256 entries in the WPG reader which may

cause denial of service.

 

CVE-2016-7997

 

Moshe Kaplan discovered that an assertion is thrown for some files in

the WPG reader due to a logic error which may cause denial of service.

 

CVE-2016-8682

 

Agostino Sarubbo of Gentoo discovered a stack buffer read overflow

while reading the SCT header which may cause denial of service.

 

CVE-2016-8683

 

Agostino Sarubbo of Gentoo discovered a memory allocation failure in the

PCX coder which may cause denial of service.

 

CVE-2016-8684

 

Agostino Sarubbo of Gentoo discovered a memory allocation failure in the

SGI coder which may cause denial of service.

 

CVE-2016-9830

 

Agostino Sarubbo of Gentoo discovered a memory allocation failure in

MagickRealloc() function which may cause denial of service.

 

For the stable distribution (jessie), these problems have been fixed in

version 1.3.20-3+deb8u2.

 

For the testing distribution (stretch), these problems (with the

exception of CVE-2016-9830) have been fixed in version 1.3.25-5.

 

For the unstable distribution (sid), these problems have been fixed in

version 1.3.25-6.

 

We recommend that you upgrade your graphicsmagick packages.

 

Further information about Debian Security Advisories, how to apply

these updates to your system and frequently asked questions can be

found at: https://www.debian.org/security/