Accepted imagemagick 8:6.9.7.4+dfsg-13 (source) into unstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 25 Jul 2017 22:13:44 +0200
Source: imagemagick
Binary: imagemagick-6-common imagemagick-6-doc libmagickcore-6-headers libmagickwand-6-headers libmagick++-6-headers libimage-magick-perl libmagickcore-6-arch-config imagemagick-6.q16 libmagickcore-6.q16-3 libmagickcore-6.q16-3-extra libmagickcore-6.q16-dev libmagickwand-6.q16-3 libmagickwand-6.q16-dev libmagick++-6.q16-7 libmagick++-6.q16-dev libimage-magick-q16-perl imagemagick-6.q16hdri libmagickcore-6.q16hdri-3 libmagickcore-6.q16hdri-3-extra libmagickcore-6.q16hdri-dev libmagickwand-6.q16hdri-3 libmagickwand-6.q16hdri-dev libmagick++-6.q16hdri-7 libmagick++-6.q16hdri-dev libimage-magick-q16hdri-perl imagemagick-common imagemagick-doc perlmagick libmagickcore-dev libmagickwand-dev libmagick++-dev imagemagick
Architecture: source
Version: 8:6.9.7.4+dfsg-13
Distribution: unstable
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Description:
imagemagick - image manipulation programs -- binaries
imagemagick-6-common - image manipulation programs -- infrastructure
imagemagick-6-doc - document files of ImageMagick
imagemagick-6.q16 - image manipulation programs -- quantum depth Q16
imagemagick-6.q16hdri - image manipulation programs -- quantum depth Q16HDRI
imagemagick-common - image manipulation programs -- infrastructure dummy package
imagemagick-doc - document files of ImageMagick -- dummy package
libimage-magick-perl - Perl interface to the ImageMagick graphics routines
libimage-magick-q16-perl - Perl interface to the ImageMagick graphics routines -- Q16 versio
libimage-magick-q16hdri-perl - Perl interface to the ImageMagick graphics routines -- Q16HDRI ve
libmagick++-6-headers - object-oriented C++ interface to ImageMagick - header files
libmagick++-6.q16-7 - C++ interface to ImageMagick -- quantum depth Q16
libmagick++-6.q16-dev - C++ interface to ImageMagick - development files (Q16)
libmagick++-6.q16hdri-7 - C++ interface to ImageMagick -- quantum depth Q16HDRI
libmagick++-6.q16hdri-dev - C++ interface to ImageMagick - development files (Q16HDRI)
libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package
libmagickcore-6-arch-config - low-level image manipulation library - architecture header files
libmagickcore-6-headers - low-level image manipulation library - header files
libmagickcore-6.q16-3 - low-level image manipulation library -- quantum depth Q16
libmagickcore-6.q16-3-extra - low-level image manipulation library - extra codecs (Q16)
libmagickcore-6.q16-dev - low-level image manipulation library - development files (Q16)
libmagickcore-6.q16hdri-3 - low-level image manipulation library -- quantum depth Q16HDRI
libmagickcore-6.q16hdri-3-extra - low-level image manipulation library - extra codecs (Q16HDRI)
libmagickcore-6.q16hdri-dev - low-level image manipulation library - development files (Q16HDRI
libmagickcore-dev - low-level image manipulation library -- dummy package
libmagickwand-6-headers - image manipulation library - headers files
libmagickwand-6.q16-3 - image manipulation library -- quantum depth Q16
libmagickwand-6.q16-dev - image manipulation library - development files (Q16)
libmagickwand-6.q16hdri-3 - image manipulation library -- quantum depth Q16HDRI
libmagickwand-6.q16hdri-dev - image manipulation library - development files (Q16HDRI)
libmagickwand-dev - image manipulation library -- dummy package
perlmagick - Perl interface to ImageMagick -- dummy package
Closes: 867778 868950 869210 869711 869712 869715 869721 869722 869725 869726 869727 869728 869769 869791 869796 869827 869830 869831 869834
Changes:
imagemagick (8:6.9.7.4+dfsg-13) unstable; urgency=high
.
* Fix a typo in changelog about CVE numbers
* Security fixes:
+ Really Fix CVE-2017-9500 (Closes: #867778)
An assertion failure was found in the function
ResetImageProfileIterator, which allows attackers to cause a denial
of service via a crafted file.
+ Fix CVE-2017-11446 (Closes: #868950)
The ReadPESImage function in coders\pes.c has an infinite
loop vulnerability that can cause CPU exhaustion via a crafted
PES file.
+ CVE-2017-11523: endless loop in ReadTXTImage
If text image file only contains "MagickID..." line,
it will cause ReadTXTImage to infinite loop.
(Closes: #869210).
+ Use after free in ReadWMFImage
When identify WMF file, a crafted file revealed a use-after-free
vulnerability. (Closes: #869715).
+ CVE-2017-11534: Memory-Leak in lite_font_map()
In coders/wmf.c a memory leak is triggered by a crafted file.
(Closes: #869711).
+ CVE-2017-11537: palm coder FPE
When ImageMagick processes a crafted file in convert, it can
lead to a Floating Point Exception (FPE) in the WritePALMImage()
function in coders/palm.c, related to an incorrect bits-per-pixel
calculation.
(Closes: #869712)
+ Memory leak in WritePALMImage
Fix memory leak due to crafted file in palm coder.
(Closes: #869721)
+ Fix another memory leak in quantize.c
(Closes: #869722)
+ CVE-2017-11531 Memory-Leak in WriteHISTOGRAMImage()
A crafted file could trigger a
Memory-Leak in WriteHISTOGRAMImage() coders/histogram.c
(Closes: #869725)
+ Avoid a crash in mpc coder
A crafted file could trigger a crash in the mpc coder.
(Closes: #869728).
+ Fix a memory leak in enhance.c
Fix a potential memory leak if memory could not be allocated for one
of histogram or stretch_map.
If both cannot be allocated, there is no memory leak. If only one is
allocated and the other fails,
there is a memory leak of the one that could not be allocated. There
is very little chance the allocations would fail.
(Closes: #869769).
+ Fix a memory leak in jpeg and mpc coder
A leak due to exception handling exist in MPC and JPEG coder.
This could be triggerd by a crafted file.
(Closes: #869791).
+ Fix memory exhaustion in mpc coder
When identify MPC file , imagemagick will allocate memory to store the
data.
The function StringToUnsignedLong convert string to unsigned long
type, but the return value was not checked.
Here is my policy.xml to limit memory usage,but 256MB limit
can be bypassed.
(Closes: #869727).
+ Fix a leak in mpc file due to corrupted profiles
(Closes: #869796).
+ CVE-2017-11532: memory leak
When Imagemagick processes a crafted file in convert,
it can lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c.
(Closes: #869726)
+ CVE-2017-11535: heap based overflow in ps.c
When ImageMagick processes a crafted file in
convert, it can lead to a heap-based buffer over-read in the
WritePSImage() function in coders/ps.c.
(Closes: #869827)
+ CVE-2017-11536 memory leak in jp2 coder
When ImageMagick processes a crafted file in convert, it
can lead to a Memory Leak in the WriteJP2Image() function in
coders/jp2.c.
(Closes: #869831)
+ Fix a crash in jp2 codec
Lack of validation of jp2 could lead to a crash
(Closes: #869830)
+ CVE-2017-11533: heap buffer overflow in uil coder
When ImageMagick processes a crafted file in convert, it can
lead to a heap-based buffer over-read in the WriteUILImage() function
in coders/uil.c.
(Closes: #869834)
Checksums-Sha1:
778f9350b0904b4d1d3989ec0a7529b47f0ff86e 5137 imagemagick_6.9.7.4+dfsg-13.dsc
862210be9fa1899ed69b0362cb308c3cf6fc3ac4 241188 imagemagick_6.9.7.4+dfsg-13.debian.tar.xz
e3fe9dcd6b8eaddb334518c0f071e70b8f2568ff 12823 imagemagick_6.9.7.4+dfsg-13_source.buildinfo
Checksums-Sha256:
826e105fe04aac90ed33b43cc3254db8b26b37ba43cc6dfabce983fa3babe116 5137 imagemagick_6.9.7.4+dfsg-13.dsc
379caf7627e27e65bd05dabc97a4cec5f4061a7833506ee18dacfdde20359c5a 241188 imagemagick_6.9.7.4+dfsg-13.debian.tar.xz
44deea041655075166508cdf3c7f17bd7beae577cbc3c1e2769f8380f63b9297 12823 imagemagick_6.9.7.4+dfsg-13_source.buildinfo
Files:
6c0488b2f6b84e5239af8b0d92dc0b12 5137 graphics optional imagemagick_6.9.7.4+dfsg-13.dsc
679553ecd05d814548f4c26f06826509 241188 graphics optional imagemagick_6.9.7.4+dfsg-13.debian.tar.xz
c20ca342a1b71726bf015e83c67258a1 12823 graphics optional imagemagick_6.9.7.4+dfsg-13_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAll5DykACgkQADoaLapB
CF/I0RAAmgxjI/+a1oRL0GxVFIhWZ3MUL9El96dmX6unc3GGLE/PD/mVe8Ua4Q2g
kGC8UrK65LgD8+nuvUFSp/uWX6OLRGRQckepfI3IxNvKSzBZmMqlGHeezF/JbMn3
8h4wuw80QydRzPeHtrEV3r5AgWA5v4smUNOeCwAFgT0J9uahGaSN6HgCqbxetUQv
bWk3FrayyXdnt+650m27zfxUslsBp8wtjmPrHrsBD5j/eozIPjFgZOImj8kGPTYI
x+soXitfahYpnILvxpHFv5qtT49uMRVALSsB6Q265voruJkJUGXYYscCaikkFxyO
WO0IqusG/2bDNb1vfpsZs0vu2WDDy6PFwM+0y/+CyGaQFRNFW+hKRsbY0ZxmZD+l
BxX3M0BZ89QxmJWfjOHc8zMzxmaBTeHnlO5EWt6hbDpaPIAO3TKr0DTx3pt0QjCx
X8Jrnr4+/VLSwtUpIXsmmRG7sDjDmiHNGI5aM0BJbc+aA49mefEs2mBVzb/RMBuP
mGag4HLisiIRf1nURr8aMzZ7kbNmPdbJSrfh2VpzfRPSVupu0dCELMzeQ1YVGwYK
lDlDQCu6+sVHl8YGupv27Yg2PJ6ywXRw+A87plD2ic6Rv+MI9T2vVYdD7S713NDv
2wYwcqAz6fLQlje0tTR9da0huGPpPbUzvU5qtDvMMyPfeoRsXLA=
=/pWP
-----END PGP SIGNATURE-----