Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

USN-1435-1: ImageMagick vulnerabilities

1 May 2012

ImageMagick could be made to crash or run programs as your login if it opened a specially crafted file.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • imagemagick - Image manipulation programs and library

Details

Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick
incorrectly handled certain ResolutionUnit tags. If a user or automated
system using ImageMagick were tricked into opening a specially crafted
image, an attacker could exploit this to cause a denial of service or
possibly execute code with the privileges of the user invoking the program.
(CVE-2012-0247, CVE-2012-1185)

Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick
incorrectly handled certain IFD structures. If a user or automated
system using ImageMagick were tricked into opening a specially crafted
image, an attacker could exploit this to cause a denial of service.
(CVE-2012-0248, CVE-2012-1186)

Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that
ImageMagick incorrectly handled certain JPEG EXIF tags. If a user or
automated system using ImageMagick were tricked into opening a specially
crafted image, an attacker could exploit this to cause a denial of service.
(CVE-2012-0259)

It was discovered that ImageMagick incorrectly handled certain JPEG EXIF
tags. If a user or automated system using ImageMagick were tricked into
opening a specially crafted image, an attacker could exploit this to cause
a denial of service or possibly execute code with the privileges of the
user invoking the program. (CVE-2012-1610)

Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that
ImageMagick incorrectly handled certain TIFF EXIF tags. If a user or
automated system using ImageMagick were tricked into opening a specially
crafted image, an attacker could exploit this to cause a denial of service
or possibly execute code with the privileges of the user invoking the
program. (CVE-2012-1798)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04

In general, a standard system update will make all the necessary changes.