USN-5335-1.json

{
  "id": "USN-5335-1",
  "summary": "imagemagick vulnerabilities",
  "details": "It was discovered that ImageMagick incorrectly handled certain values\nwhen processing XPM image data or large images. If a user or automated\nsystem using ImageMagick were tricked into opening a specially crafted\nimage, an attacker could exploit this to cause a denial of service or\npossibly execute code with the privileges of the user invoking the program.\n(CVE-2020-19667, CVE-2017-13144)\n\nSuhwan Song discovered that ImageMagick incorrectly handled memory\nwhen processing PNG,PALM,MIFF image data. If a user or automated system\nusing ImageMagick were tricked into opening a specially crafted image,\nan attacker could exploit this to cause a denial of service or possibly\nexecute code with the privileges of the user invoking the program.\n(CVE-2020-25664, CVE-2020-25665, CVE-2020-25674, CVE-2020-27753)\n\nSuhwan Song discovered that ImageMagick incorrectly handled certain values\nwhen processing image data. If a user or automated system using\nImageMagick were tricked into opening a specially crafted image, an\nattacker could exploit this to cause a denial of service.\n(CVE-2020-25676, CVE-2020-27750, CVE-2020-27760, CVE-2020-27762,\nCVE-2020-27766, CVE-2020-27770)\n\nZhang Xiaohui discovered that ImageMagick incorrectly handled certain values\nwhen processing image data. If a user or automated system using\nImageMagick were tricked into opening a specially crafted image, an\nattacker could exploit this to cause a denial of service.\n(CVE-2021-20176, CVE-2021-20241, CVE-2021-20243)\n",
  "aliases": [],
  "related": [
    "CVE-2017-13144",
    "CVE-2020-19667",
    "CVE-2020-25664",
    "CVE-2020-25665",
    "CVE-2020-25674",
    "CVE-2020-25676",
    "CVE-2020-27750",
    "CVE-2020-27753",
    "CVE-2020-27760",
    "CVE-2020-27762",
    "CVE-2020-27766",
    "CVE-2020-27770",
    "CVE-2021-20176",
    "CVE-2021-20241",
    "CVE-2021-20243"
  ],
  "published": "2022-03-18T11:18:34.498816Z",
  "modified": "2022-03-18T11:18:34.498816Z",
  "affected": [
    {
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "imagemagick"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8:6.8.9.9-7ubuntu5.16+esm2"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "imagemagick-common": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-6.q16-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "imagemagick": "8:6.8.9.9-7ubuntu5.16+esm2",
            "imagemagick-doc": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickwand-6.q16-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagick++-6-headers": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libimage-magick-q16-perl": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickwand-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libimage-magick-perl": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagick++-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "imagemagick-6.q16": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagick++-6.q16-5v5": "8:6.8.9.9-7ubuntu5.16+esm2",
            "perlmagick": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickwand-6.q16-2": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-6-headers": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-6-arch-config": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagick++-6.q16-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-6.q16-2-extra": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-dev": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickwand-6-headers": "8:6.8.9.9-7ubuntu5.16+esm2",
            "libmagickcore-6.q16-2": "8:6.8.9.9-7ubuntu5.16+esm2"
          }
        ],
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5335-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-13144"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-19667"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25664"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25665"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25674"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-25676"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27750"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27753"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27760"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27762"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27766"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-27770"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20176"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20241"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-20243"
    }
  ]
}