UbuntuUpdates.org

Package "libmagickcore-6-arch-config"

Name: libmagickcore-6-arch-config

Description:

low-level image manipulation library - architecture header files
Latest version: 8:6.9.7.4+dfsg-16ubuntu6.15
Release: bionic (18.04)
Level: security
Repository: main
Head package: imagemagick
Homepage: http://www.imagemagick.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libmagickcore-6-arch-config"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libmagickcore-6-arch-config" in Bionic

Repository Area Version
base main 8:6.9.7.4+dfsg-16ubuntu6
updates main 8:6.9.7.4+dfsg-16ubuntu6.15

Changelog

Version: 8:6.9.7.4+dfsg-16ubuntu6.15 2023-02-09 23:07:06 UTC

  imagemagick (8:6.9.7.4+dfsg-16ubuntu6.15) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS and information disclosure via PNG parsing
    - debian/patches/CVE-2022-4426x.patch: properly handle certain keys in
      coders/png.c.
    - CVE-2022-44267
    - CVE-2022-44268

 -- Marc Deslauriers <email address hidden> Thu, 09 Feb 2023 12:11:42 -0500
Source diff to previous version
CVE-2022-4426 The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that
CVE-2022-44267 ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for
CVE-2022-44268 ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded

Version: 8:6.9.7.4+dfsg-16ubuntu6.14 2022-11-24 09:06:22 UTC

  imagemagick (8:6.9.7.4+dfsg-16ubuntu6.14) bionic-security; urgency=medium

  * SECURITY UPDATE: integer overflow in ExportIndexQuantum()
    - debian/patches/CVE-2021-20224.patch: outside the range of representable
      values of type 'unsigned char'
    - CVE-2021-20224
  * SECURITY UPDATE: Division by zero in coders/jp2.c
    - debian/patches/CVE-2021-20241.patch: Use PerceptibleReciprocal()
      to fix division by zeros in coders/jp2.c
    - CVE-2021-20241
  * SECURITY UPDATE: Division by zero in magick/resize.c
    - debian/patches/CVE-2021-20243.patch: Use PerceptibleReciprocal()
      to fix division by zeros in magick/resize.c
    - CVE-2021-20243
  * SECURITY UPDATE: out-of-range value
    - debian/patches/CVE-2022-32545.patch: addresses the possibility for the
      use of a value that falls outside the range of an unsigned char in
      coders/psd.c.
    - CVE-2022-32545
  * SECURITY UPDATE: out-of-range value
    - debian/patches/CVE-2022-32546.patch: addresses the possibility for the
      use of a value that falls outside the range of an unsigned long in
      coders/pcl.c.
    - CVE-2022-32546
  * SECURITY UPDATE: load of misaligned address
    - debian/patches/CVE-2022-32547.patch: addresses the potential for the
      loading of misaligned addresses in magick/property.c.
    - CVE-2022-32547

 -- Nishit Majithia <email address hidden> Mon, 21 Nov 2022 20:46:27 +0530
Source diff to previous version
CVE-2021-20224 An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelInd
CVE-2021-20241 A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha
CVE-2021-20243 A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefin
CVE-2022-32545 A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted
CVE-2022-32546 A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted
CVE-2022-32547 In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte al

Version: 8:6.9.7.4+dfsg-16ubuntu6.13 2022-06-01 17:06:18 UTC

  imagemagick (8:6.9.7.4+dfsg-16ubuntu6.13) bionic-security; urgency=medium

  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2022-28463.patch: fix buffer overflow
    - CVE-2022-28463

 -- Emilia Torino <email address hidden> Tue, 31 May 2022 11:52:54 -0300
Source diff to previous version
CVE-2022-28463 ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.

Version: 8:6.9.7.4+dfsg-16ubuntu6.12 2021-11-29 09:07:06 UTC

  imagemagick (8:6.9.7.4+dfsg-16ubuntu6.12) bionic-security; urgency=medium

  * SECURITY UPDATE: Multiple divide by zero issues in imagemagick allow a
    remote attacker to cause a denial of service via a crafted image file
    - debian/patches/CVE-2021-20244.patch: Avoid division by zero in
      magick/fx.c
    - debian/patches/CVE-2021-20309.patch: Avoid division by zero in
      magick/fx.c
    - debian/patches/CVE-2021-20246.patch: Avoid division by zero in
      magick/resample.c
    - CVE-2021-20244, CVE-2021-20309, CVE-2021-20246
  * SECURITY UPDATE: Integer overflow, divide by zero and memory leak in
    imagemagick allow a remote attacker to cause a denial of service or
    possible leak of cryptographic information via a crafted image file
    - debian/patches/CVE-2021-20312.patch: Avoid integer overflow in
      coders/thumbnail.c, division by zero in magick/colorspace.c and
      a potential cipher leak in magick/memory.c
    - CVE-2021-20312, CVE-2021-20313

 -- Ray Veldkamp <email address hidden> Thu, 18 Nov 2021 20:39:34 +1100
Source diff to previous version
CVE-2021-20244 A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger
CVE-2021-20309 A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c m
CVE-2021-20246 A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undef
CVE-2021-20312 A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined beha
CVE-2021-20313 A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. T

Version: 8:6.9.7.4+dfsg-16ubuntu6.11 2021-06-15 13:06:24 UTC

  imagemagick (8:6.9.7.4+dfsg-16ubuntu6.11) bionic-security; urgency=medium

  * SECURITY UPDATE: multiple security issues
    - debian/patches/CVE-*.patch: backport multiple upstream commits.
    - CVE-2017-14528, CVE-2020-19667, CVE-2020-25665, CVE-2020-25666,
      CVE-2020-25674, CVE-2020-25675, CVE-2020-25676, CVE-2020-27750,
      CVE-2020-27751, CVE-2020-27753, CVE-2020-27754, CVE-2020-27755,
      CVE-2020-27757, CVE-2020-27758, CVE-2020-27759, CVE-2020-27754,
      CVE-2020-27760, CVE-2020-27761, CVE-2020-27762, CVE-2020-27763,
      CVE-2020-27764, CVE-2020-27765, CVE-2020-27766, CVE-2020-27767,
      CVE-2020-27768, CVE-2020-27769, CVE-2020-27770, CVE-2020-27771,
      CVE-2020-27772, CVE-2020-27773, CVE-2020-27774, CVE-2020-27775,
      CVE-2020-27776, CVE-2021-20176

 -- Marc Deslauriers <email address hidden> Thu, 10 Jun 2021 08:14:59 -0400
CVE-2017-14528 The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply
CVE-2020-19667 Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
CVE-2020-25665 The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 2
CVE-2020-25666 There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs
CVE-2020-25674 WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buf
CVE-2020-25675 In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was caus
CVE-2020-25676 In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in
CVE-2020-27750 A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed
CVE-2020-27751 A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger
CVE-2020-27753 There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted
CVE-2020-27754 In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageM
CVE-2020-27755 in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image
CVE-2020-27757 A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value out
CVE-2020-27758 A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha
CVE-2020-27759 In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the
CVE-2020-27760 In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero condition when a crafted input
CVE-2020-27761 WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable
CVE-2020-27762 A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha
CVE-2020-27763 A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefin
CVE-2020-27764 In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-
CVE-2020-27765 A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefi
CVE-2020-27766 A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger unde
CVE-2020-27767 A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefi
CVE-2020-27768 In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects Image
CVE-2020-27769 In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCore/quantize.c.
CVE-2020-27770 Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to
CVE-2020-27771 In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representa
CVE-2020-27772 A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha
CVE-2020-27773 A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger un
CVE-2020-27774 A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger unde
CVE-2020-27775 A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefi
CVE-2020-27776 A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger unde
CVE-2021-20176 A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is proc


About   -   Send Feedback to @ubuntu_updates