MGASA-2024-0064 - Updated imagemagick packages fix security vulnerabilities

Publication date: 15 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0064.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2021-3610,
     CVE-2023-3195,
     CVE-2023-3428,
     CVE-2023-34151

The updated packages fix security vulnerabilities:
A heap-based buffer overflow vulnerability was found in ImageMagick in
versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This
issue is due to an incorrect setting of the pixel array size, which can
lead to a crash and segmentation fault. (CVE-2021-3610)
A stack-based buffer overflow issue was found in ImageMagick's
coders/tiff.c. This flaw allows an attacker to trick the user into
opening a specially crafted malicious tiff file, causing an application
to crash, resulting in a denial of service. (CVE-2023-3195)
A heap-based buffer overflow vulnerability was found in coders/tiff.c in
ImageMagick. This issue may allow a local attacker to trick the user
into opening a specially crafted file, resulting in an application crash
and denial of service. (CVE-2023-3428)
This security flaw ouccers as an undefined behaviors of casting double
to size_t in svg, mvg and other coders (recurring bugs of
CVE-2022-32546). (CVE-2023-34151)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32076
- https://ubuntu.com/security/notices/USN-6200-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3610
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3195
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3428
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34151

SRPMS:
- 9/core/imagemagick-7.1.1.29-1.mga9
- 9/tainted/imagemagick-7.1.1.29-1.mga9.tainted