This update for ImageMagick fixes several issues.
These security issues were fixed:
- CVE-2018-8804: The WriteEPTImage function allowed remote attackers to cause a
denial of service (double free and application crash) or possibly have
unspecified other impact via a crafted file (bsc#1086011).
- CVE-2017-11524: The WriteBlob function allowed remote attackers to cause a
denial of service (assertion failure and application exit) via a crafted file
(bsc#1050087).
- CVE-2017-18209: Prevent NULL pointer dereference in the
GetOpenCLCachedFilesDirectory function caused by a memory allocation result
that was not checked, related to GetOpenCLCacheDirectory (bsc#1083628).
- CVE-2017-18211: Prevent NULL pointer dereference in the function
saveBinaryCLProgram caused by a program-lookup result not being checked,
related to CacheOpenCLKernel (bsc#1083634).
- CVE-2017-9500: Prevent assertion failure in the function
ResetImageProfileIterator, which allowed attackers to cause a denial of service
via a crafted file (bsc#1043290).
- CVE-2017-14739: The AcquireResampleFilterThreadSet function mishandled failed
memory allocation, which allowed remote attackers to cause a denial of service
(NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and
application crash) via unspecified vectors (bsc#1060382).
- CVE-2017-16353: Prevent memory information disclosure in the DescribeImage
function caused by a heap-based buffer over-read. The portion of the code
containing the vulnerability is responsible for printing the IPTC Profile
information contained in the image. This vulnerability can be triggered with a
specially crafted MIFF file. There is an out-of-bounds buffer dereference
because certain increments were never checked (bsc#1066170).
- CVE-2017-16352: Prevent a heap-based buffer overflow in the 'Display visual
image directory' feature of the DescribeImage() function. One possible way to
trigger the vulnerability is to run the...