Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.5974.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5974-1)
Summary:	The remote host is missing an update for the 'graphicsmagick' package(s) announced via the USN-5974-1 advisory.
Description:	Summary: The remote host is missing an update for the 'graphicsmagick' package(s) announced via the USN-5974-1 advisory. Vulnerability Insight: It was discovered that GraphicsMagick was not properly performing bounds checks when processing TGA image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted TGA image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20184) It was discovered that GraphicsMagick was not properly validating bits per pixel data when processing DIB image files. If a user or automated system were tricked into processing a specially crafted DIB image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20189) It was discovered that GraphicsMagick was not properly processing bit-field mask values in BMP image files, which could result in the execution of an infinite loop. If a user or automated system were tricked into processing a specially crafted BMP image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-5685) It was discovered that GraphicsMagick was not properly validating data used in arithmetic operations when processing MNG image files, which could result in a divide-by-zero error. If a user or automated system were tricked into processing a specially crafted MNG image file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-9018) It was discovered that GraphicsMagick was not properly performing bounds checks when processing MIFF image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MIFF image file, an attacker could possibly use this issue to cause a denial of service or expose sensitive information. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2019-11006) It was discovered that GraphicsMagick did not properly magnify certain MNG image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MNG image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-12672) It was discovered that GraphicsMagick was not properly performing bounds checks when parsing certain MIFF image files, which could lead to a heap buffer overflow. If a user or automated system were tricked into processing a specially crafted MIFF image file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-1270) Affected Software/OS: 'graphicsmagick' package(s) on Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-20184 BugTraq ID: 106229 http://www.securityfocus.com/bid/106229 Debian Security Information: DSA-4640 (Google Search) https://www.debian.org/security/2020/dsa-4640 http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/15d1b5fd003b https://sourceforge.net/p/graphicsmagick/bugs/583/ https://lists.debian.org/debian-lts-announce/2018/12/msg00018.html https://usn.ubuntu.com/4207-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-20189 BugTraq ID: 106227 http://www.securityfocus.com/bid/106227 http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/648e2b406589 https://sourceforge.net/p/graphicsmagick/bugs/585/ Common Vulnerability Exposure (CVE) ID: CVE-2018-5685 Debian Security Information: DSA-4321 (Google Search) https://www.debian.org/security/2018/dsa-4321 http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/52a91ddb1aa6 https://sourceforge.net/p/graphicsmagick/bugs/541/ https://lists.debian.org/debian-lts-announce/2018/01/msg00018.html https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html Common Vulnerability Exposure (CVE) ID: CVE-2018-9018 BugTraq ID: 103526 http://www.securityfocus.com/bid/103526 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FS76VNCFL3FVRMGXQEMHBOKA7EE46BTS/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3IYH7QSNXXOIDFTYLY455ANZ3JWQ7FCS/ https://sourceforge.net/p/graphicsmagick/bugs/554/ https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html Common Vulnerability Exposure (CVE) ID: CVE-2019-11006 http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/f7610c1281c1 https://sourceforge.net/p/graphicsmagick/bugs/598/ https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html SuSE Security Announcement: openSUSE-SU-2019:1272 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html SuSE Security Announcement: openSUSE-SU-2019:1295 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html Common Vulnerability Exposure (CVE) ID: CVE-2020-12672 https://security.gentoo.org/glsa/202209-19 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19025 https://lists.debian.org/debian-lts-announce/2020/06/msg00004.html SuSE Security Announcement: openSUSE-SU-2020:0779 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00008.html SuSE Security Announcement: openSUSE-SU-2020:0788 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00012.html Common Vulnerability Exposure (CVE) ID: CVE-2022-1270 Debian Security Information: DSA-5288 (Google Search) https://www.debian.org/security/2022/dsa-5288 https://sourceforge.net/p/graphicsmagick/bugs/664/ https://lists.debian.org/debian-lts-announce/2022/11/msg00028.html
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.