この更新では、imagemagickでの多数の脆弱性を修正しています: 無効な形式のTGA、Sun、またはPSDのファイルが処理される場合、さまざまなメモリ処理の問題があり、入力サニタイズが欠如しているか不完全であるならば、サービス拒否を引き起こすか、任意のコードを実行する可能性があります。

今回の更新では、CMYK 画像上で -sharpen を実行する際の視覚的なアーチファクトも修正されました（セキュリティ上の影響はありませんが、wheezyと比較してjessieで回帰が発生するため、Debian安定版（stable）リリースマネージャーの承認を得て、セキュリティ更新に便乗しました）。

此更新可修复 imagemagick 中的数个漏洞：如果处理格式错误的 TGA、Sun 或 PSD 文件，多个内存处理问题和缺少或不完整输入清理的情况可导致拒绝服务或执行任意代码。此更新还修复了对 CMYK 图像运行 -sharpen 时的视觉伪影（无安全影响，但经 Debian 稳定版本经理批准后顺带附加至此安全更新，因为它在 jessie 中与 wheezy 相比属于回归）。

此更新可修正 imagemagick 中的數個弱點：如果處理格式錯誤的 TGA、Sun 或 PSD 檔案，各種記憶體處理問題和缺少或不完整的輸入清理情況可能會導致拒絕服務，或是造成執行任意程式碼。此更新也修正了在 CMYK 影像上執行 -sharpen 時出現的視覺偽像 (無安全性影響，但由於相較於 wheezy，此為 jessie 中的迴歸問題，因此經過 Debian 穩定版本管理員的核准搭附在安全性更新上)。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 6.9.2-2之前的 ImageMagick 中，MagickCore/option.c 的 IsOptionMember 函式存在記憶體洩漏問題，在 ODR-PadEnc 和其他產品中使用時，會讓攻擊者觸發記憶體消耗。 (CVE-2016-10252)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 6.9.2-2之前的 ImageMagick 版中 MagickCore/option.c 的 IsOptionMember 函数中发生内存泄漏，在 ODR-PadEnc 和其他产品中使用时，攻击者可触发内存消耗。 (CVE-2016-10252)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ODR-PadEnc およびその他の製品で使用されている 6.9.2-2より前の ImageMagick の MagickCore/option.c の IsOptionMember 関数のメモリリークにより、攻撃者がメモリ消費をトリガーすることができます。 （CVE-2016-10252）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used     in ODR-PadEnc and other products, allows attackers to trigger memory consumption. (CVE-2016-10252)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TGA, Sun or PSD files are processed.

This update also fixes visual artefacts when running -sharpen on CMYK images (no security impact, but piggybacked on top of the security update with approval of the Debian stable release managers since it's a regression in jessie compared to wheezy).

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ImageMagick is an image display and manipulation tool     for the X Window System. ImageMagick can read and write     JPEG, TIFF, PNM, GIF,and Photo CD image formats. It can     resize, rotate, sharpen, color reduce, or add special     effects to an image, and when finished you can either     save the completed work in the original format or a     different one. ImageMagick also includes command line     programs for creating animated or transparent .gifs,     creating composite images, creating thumbnail images,     and more.ImageMagick is one of your choices if you need     a program to manipulate and display images. If you want     to develop your own applications which use ImageMagick     code or APIs, you need to install ImageMagick-devel as     well.Security Fix(es):In ImageMagick before 7.0.8-8, a     NULL pointer dereference exists in the     GetMagickProperty function in     MagickCore/property.c.(CVE-2018-16329)ImageMagick     before 6.9.9-24 and 7.x before 7.0.7-12 has a     use-after-free in Magick::Image::read in     Magick++/lib/Image.cpp.(CVE-2017-17499)In ImageMagick     before 6.9.8-5 and 7.x before 7.0.5-6, there is a     memory leak in the ReadMATImage function in     coders/mat.c.(CVE-2017-13146)In ImageMagick before     6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage     function in coders/mat.c uses uninitialized data, which     might allow remote attackers to obtain sensitive     information from process memory.(CVE-2017-13143)In     ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the     ReadOneMNGImage function in coders/png.c has an     out-of-bounds read with the MNG CLIP     chunk.(CVE-2017-13139)coders/psd.c in ImageMagick     allows remote attackers to have unspecified impact via     a crafted PSD file, which triggers an out-of-bounds     write.(CVE-2017-5510)coders/psd.c in ImageMagick allows     remote attackers to have unspecified impact via a     crafted PSD file, which triggers an out-of-bounds     write.(CVE-2017-5509)Memory leak in coders/mpc.c in     ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4     allows remote attackers to cause a denial of service     (memory consumption) via vectors involving a pixel     cache.(CVE-2017-5507)Memory leak in the IsOptionMember     function in MagickCore/option.c in ImageMagick before     6.9.2-2, as used in ODR-PadEnc and other products,     allows attackers to trigger memory     consumption.(CVE-2016-10252)Off-by-one error in     coders/wpg.c in ImageMagick allows remote attackers to     have unspecified impact via vectors related to a string     copy.(CVE-2016-10145)Memory leak in     AcquireVirtualMemory in ImageMagick before 7 allows     remote attackers to cause a denial of service (memory     consumption) via unspecified vectors.(CVE-2016-7539)In     coders/bmp.c in ImageMagick before 7.0.8-16, an input     file can result in an infinite loop and hang, with high     CPU and memory consumption. Remote attackers could     leverage this vulnerability to cause a denial of     service via a crafted file.(CVE-2018-20467)In     ImageMagick before 7.0.8-8, a NULL pointer dereference     exists in the CheckEventLogging function in     MagickCore/log.c.(CVE-2018-16328)ReadXBMImage in     coders/xbm.c in ImageMagick before 7.0.8-9 leaves data     uninitialized when processing an XBM file that has a     negative pixel value. If the affected code is used as a     library loaded into a process that includes sensitive     information, that information sometimes can be leaked     via the image data.(CVE-2018-16323)WriteEPTImage in     coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote     attackers to cause a denial of service     (MagickCore/memory.c double free and application crash)     or possibly have unspecified other impact via a crafted     file.(CVE-2018-8804)In ImageMagick 7.0.8-3 Q16,     ReadDIBImage and WriteDIBImage in coders/dib.c allow     attackers to cause an out of bounds write via a crafted     file.(CVE-2018-12600)ImageMagick version 7.0.7-2     contains a memory leak in ReadYUVImage in     coders/yuv.c.(CVE-2017-15033)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
97699	Debian DSA-3808-1: imagemagick - セキュリティ更新	Nessus	Debian Local Security Checks	2017/3/14	2021/1/11	high
97699	Debian DSA-3808-1：imagemagick - 安全更新	Nessus	Debian Local Security Checks	2017/3/14	2021/1/11	high
97699	Debian DSA-3808-1：imagemagick - 安全性更新	Nessus	Debian Local Security Checks	2017/3/14	2021/1/11	high
219452	Linux Distros 未修補弱點：CVE-2016-10252	Nessus	Misc.	2025/3/4	2025/9/15	high
219452	Linux Distros 未修补的漏洞: CVE-2016-10252	Nessus	Misc.	2025/3/4	2025/9/15	high
219452	Linux Distros のパッチ未適用の脆弱性: CVE-2016-10252	Nessus	Misc.	2025/3/4	2025/9/15	high
219452	Linux Distros Unpatched Vulnerability : CVE-2016-10252	Nessus	Misc.	2025/3/4	2025/9/15	high
97699	Debian DSA-3808-1 : imagemagick - security update	Nessus	Debian Local Security Checks	2017/3/14	2021/1/11	high
135519	EulerOS 2.0 SP3 : ImageMagick (EulerOS-SA-2020-1390)	Nessus	Huawei Local Security Checks	2020/4/15	2021/2/9	critical
131846	EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2019-2354)	Nessus	Huawei Local Security Checks	2019/12/10	2021/2/9	critical
130869	EulerOS 2.0 SP5 : ImageMagick (EulerOS-SA-2019-2160)	Nessus	Huawei Local Security Checks	2019/11/12	2021/2/9	critical

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

critical

critical

critical