-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 12 Feb 2024 20:15:47 +0000 Source: imagemagick Binary: imagemagick-6-common imagemagick-6-doc imagemagick-common imagemagick-doc libimage-magick-perl libmagick++-6-headers libmagick++-dev libmagickcore-6-headers libmagickcore-dev libmagickwand-6-headers libmagickwand-dev perlmagick Architecture: all Version: 8:6.9.11.60+dfsg-1.6+deb12u1 Distribution: bookworm-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Bastien Roucariès Description: imagemagick-6-common - image manipulation programs -- infrastructure imagemagick-6-doc - document files of ImageMagick imagemagick-common - image manipulation programs -- infrastructure dummy package imagemagick-doc - document files of ImageMagick -- dummy package libimage-magick-perl - Perl interface to the ImageMagick graphics routines libmagick++-6-headers - object-oriented C++ interface to ImageMagick - header files libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package libmagickcore-6-headers - low-level image manipulation library - header files libmagickcore-dev - low-level image manipulation library -- dummy package libmagickwand-6-headers - image manipulation library - headers files libmagickwand-dev - image manipulation library -- dummy package perlmagick - Perl interface to ImageMagick -- dummy package Closes: 1013282 1036999 Changes: imagemagick (8:6.9.11.60+dfsg-1.6+deb12u1) bookworm-security; urgency=high . * Acknowledge NMU * Fix CVE-2021-3610 heap buffer overflow vulnerability in TIFF coder * Fix an heap buffer overflow in TIFF coder * Fix uninitialised value passing in TIFFGetField * Fix stack overflow in TIFF coder * Early exit in case of malformed TIFF file * Fix buffer overrun in TIFF coder * Fix unitialised value in TIFF coder * Fix CVE-2022-1115: Heap based overflow in TIFF coder (Closes: #1013282) * Fix uninitialised value in TIFF coders * Use salsa-ci * Fix CVE-2023-1289: A specially created SVG file loaded itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. * Fix CVE-2023-1906: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. * Fix CVE-2023-34151: Imagemagick was vulnerable due to an undefined behaviors of casting double to size_t in svg, mvg and other coders. (Closes: #1036999) * Fix CVE-2023-3428: A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service. * Fix CVE-2023-5341: A heap use-after-free flaw was found in coders/bmp.c Checksums-Sha1: d10303ba8bab1f5ed009c2f947a1d09e79fa0fcb 166244 imagemagick-6-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb f77e7ddcbb8679f97a021e2fecf5e98c60750f9a 7888740 imagemagick-6-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb fe541f9680265e182b27739065959918b74b197b 1512 imagemagick-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb 05afb6676aacc54569c97b03fae923e7faf0aa76 1616 imagemagick-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb 7968f800f79f0f1039cdeac0d96c98c43aa15b6c 18365 imagemagick_6.9.11.60+dfsg-1.6+deb12u1_all-buildd.buildinfo 2913a117419b39ac167b89a70a2d4de2bfecaef2 53308 libimage-magick-perl_6.9.11.60+dfsg-1.6+deb12u1_all.deb 84996784fd7abb70c9184e496e106f283a08afac 47516 libmagick++-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb 9bc950a3b8a0727af17b66bca2500a0f0b5bc6d2 1364 libmagick++-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 46ea6a321454ef91415907fbaf9ed45bf31673af 50924 libmagickcore-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb 0032c29fb709ff9612771a408494959e17908fed 1336 libmagickcore-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 95dea797a29ef803ecad7d712a4cf57fa9196656 10500 libmagickwand-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb 864c11c4472c2eb3c4795f45ec823ef62a57548c 1324 libmagickwand-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb eb1124d9925ea3667a77195e060efc29fe4f2c78 1360 perlmagick_6.9.11.60+dfsg-1.6+deb12u1_all.deb Checksums-Sha256: 0511151fede5ee00defb3a96a8122e3b14c961f7e4349d9e4ddc35462d90142b 166244 imagemagick-6-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb 0f12cf8c52302e89b60bc42375f92b6988986c1e67307131fc11ed71112a194c 7888740 imagemagick-6-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb dc416f66bd97b30f9470bf17ff14110c6859e32660f57614f485fafac13d8360 1512 imagemagick-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb 1b225594a95fbb1f95eb63aa1a27fc2b45bb4d5ab4be9a473fc5a5e19362ec7b 1616 imagemagick-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb f288412e8b43170c5408132511c595d968d30bcf81114020a20ce2cd5a773709 18365 imagemagick_6.9.11.60+dfsg-1.6+deb12u1_all-buildd.buildinfo 414a91564dc3aadc66c368a5cda5a3f4e1b31f0b0aaa696c7504c019989a3557 53308 libimage-magick-perl_6.9.11.60+dfsg-1.6+deb12u1_all.deb aa92ae0251e9bb284246a7a7b942e0ca29f8f08c5f26d885278a4f5a923971e0 47516 libmagick++-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb a95ac6f56d2089109bc204a83bbd075822fc4be8c773dbc34489ad53f824e4ec 1364 libmagick++-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb b367b4e13a76b53b740c2b994f5ab37bd3b38ee94ffb73be5209a10192deccd0 50924 libmagickcore-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb bda6e96ed726c369f0e73a7f433e470877f4e7cba5a2d4959fd82b3537d2a84d 1336 libmagickcore-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb ff9dd6f66e8973c3ec116f4ac374c51db16cf492b4302612dfbb612ecccbb62d 10500 libmagickwand-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb d76e55538dbc72785760a8f4cc4f370e045a555184c26d24165b36e48cc21d45 1324 libmagickwand-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 7c7932fa35636f2963edbdff8ff192b316396584793641f4ccdc9b02b0b14481 1360 perlmagick_6.9.11.60+dfsg-1.6+deb12u1_all.deb Files: fc748e234b7917bd4678abeb83e1542c 166244 graphics optional imagemagick-6-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb 6dca004ac6a503bd1f2cd2a4e0c86d81 7888740 doc optional imagemagick-6-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb cc9d80260131bf63996c8314ba082562 1512 oldlibs optional imagemagick-common_6.9.11.60+dfsg-1.6+deb12u1_all.deb 7e094f1362dda39ed88b105ebaa79e36 1616 oldlibs optional imagemagick-doc_6.9.11.60+dfsg-1.6+deb12u1_all.deb 90d08c2d5761c3ad52860c2f089b52c5 18365 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u1_all-buildd.buildinfo 4dcb012f9ff8c5ee149b6a914f0671c6 53308 perl optional libimage-magick-perl_6.9.11.60+dfsg-1.6+deb12u1_all.deb e519a514c750d6730085661ecaa971d6 47516 libdevel optional libmagick++-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb 7521e1aaa00f25b5b41db3041a380b0a 1364 oldlibs optional libmagick++-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 271553128d8ae86b152d6e96c0f89197 50924 libdevel optional libmagickcore-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb 93d928024ec491b4e385b40508410ac8 1336 oldlibs optional libmagickcore-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 2c8e23c7cc82975b124b3cbff519bac1 10500 libdevel optional libmagickwand-6-headers_6.9.11.60+dfsg-1.6+deb12u1_all.deb b3d8a891bac86d579264fd0e8be14694 1324 oldlibs optional libmagickwand-dev_6.9.11.60+dfsg-1.6+deb12u1_all.deb 01451bc06c4928cc9be177b3bdf3fb34 1360 oldlibs optional perlmagick_6.9.11.60+dfsg-1.6+deb12u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzW1K1578DQd6MDTQEbLkkg2OS0oFAmXPsaQACgkQEbLkkg2O S0pOuw//dZiE/KJI21njs2ufkvE6uDmx4/BohwYIeUIIkqrC5Lzn4ZJsUabb6+R+ 8RUPWEQm9hoto0JO6ZapaPbgd4xCgvA9N8dBSU3z+ikUrqLC3fZcv3VqaXpCkoZN Hr1SUKYW3ZfLBRMfgziVgCswh3vEaDZDQPnixZX9xVFygB+2aJosKmJybJx9MXwI 7Sjn29uHXnRhv/afPmymO5f6q3Uzhy7f0R3D6fBCjjogQvrq+07Bam2Ppu7Jus8J SzMsIKU7D23VtnKgaRqwEbR+lOdobQbMGFn5t+uMSIgJ0ub3XUmvJNKrqZL/V/o/ CUnd+DimYaXyowH677MVWtVDJJhxctgXuagVJx0Dk9z03eyMr/tuyys6NcRgrCyU tn8dGa3nDNfYAIS5HB0EYmjOHcdpf4/4c5GztGfw/OeVDLzVr1/eyswMRmylIEaK 8VzxYm+C15qZonYLeH/v0YFpp2YUP99Z6iNGPVXZonT4F9pgv2c0a/qeZyaURr4W tsEL57rVN0zaFfF2NUFBJsMDh1Pybr9qEZg6fDEWpoxCMS1X4HSRbkQ8mH9SLDpv oEyvcRF2iBegcAgmfacaWyzsPxdbmF9UXqYpFjrgg379LgQg679JuMQOERham8Li pCGoquSWFW9202VyUsuIIGxnnJGOGosRspiJiXZsqm1TX88qTnM= =sWaS -----END PGP SIGNATURE-----