Multiple vulnerabilities have been discovered in GraphicsMagick, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.3.40 | >= 1.3.40 |
GraphicsMagick is a collection of tools and libraries which support reading, writing, and manipulating images in many major formats.
Multiple vulnerabilities have been discovered in GraphicsMagick. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.3.40"
Multiple vulnerabilities have been discovered in GraphicsMagick, the worst of which are fuzzing issues presumed to allow for arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.3.38 | >= 1.3.38 |
GraphicsMagick is a collection of tools and libraries which support reading, writing, and manipulating images in many major formats.
Multiple vulnerabilities have been discovered in GraphicsMagick. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.3.38"
Multiple vulnerabilities have been found in GraphicsMagick, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.3.18 | >= 1.3.18 |
GraphicsMagick is the Swiss army knife of image processing.
Multiple vulnerabilities have been discovered in GraphicsMagick. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially-crafted image file, potentially resulting in arbitrary code execution or a Denial of Service condition.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.3.18"
GraphicsMagick improperly handles PALM and DCM images, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.1.7-r3 | >= 1.1.7-r3 |
GraphicsMagick is a collection of tools and libraries which support reading, writing, and manipulating images in many major formats.
M. Joonas Pihlaja has reported that a boundary error exists within the ReadDCMImage() function of coders/dcm.c, causing the improper handling of DCM images. Pihlaja also reported that there are several boundary errors in the ReadPALMImage() function of coders/palm.c, similarly causing the improper handling of PALM images.
An attacker could entice a user to open a specially crafted DCM or PALM image with GraphicsMagick, and possibly execute arbitrary code with the privileges of the user running GraphicsMagick.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.7-r3"
A vulnerability in GraphicsMagick allows attackers to crash the application and potentially execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.1.7 | >= 1.1.7 |
GraphicsMagick is a collection of tools to read, write and manipulate images in many formats.
The SetImageInfo function was found vulnerable to a format string mishandling. Daniel Kobras discovered that the handling of "%"-escaped sequences in filenames passed to the function is inadequate in ImageMagick GLSA 200602-06 and the same vulnerability exists in GraphicsMagick.
By feeding specially crafted file names to GraphicsMagick an attacker can crash the program and possibly execute arbitrary code with the privileges of the user running GraphicsMagick.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.7"
ImageMagick and GraphicsMagick utilities can be abused to perform a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.1.6-r1 | >= 1.1.6-r1 |
| media-gfx/imagemagick | * | < 6.2.2.3 | >= 6.2.2.3 |
Both ImageMagick and GraphicsMagick are collection of tools to read, write and manipulate images in many formats.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a Denial of Service vulnerability in the XWD decoder of ImageMagick and GraphicsMagick when setting a color mask to zero.
A remote attacker could submit a specially crafted image to a user or an automated system making use of an affected utility, resulting in a Denial of Service by consumption of CPU time.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.2.3"
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.6-r1"
GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.1.5 | >= 1.1.5 |
GraphicsMagick is a collection of tools to read, write and manipulate images in many formats. GraphicsMagick is originally derived from ImageMagick 5.5.2.
Andrei Nigmatulin discovered that handling a Photoshop Document (PSD) file with more than 24 layers in ImageMagick could trigger a heap overflow (GLSA 200501-26). GraphicsMagick is based on the same code and therefore suffers from the same flaw.
An attacker could potentially design a malicious PSD image file to cause arbitrary code execution with the permissions of the user running GraphicsMagick.
There is no known workaround at this time.
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.5"