Back to imagemagick PTS page

Accepted imagemagick 8:6.9.10.23+dfsg-2.1+deb10u2 (source) into oldstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 11 Mar 2023 15:05:45 +0000
Source: imagemagick
Architecture: source
Version: 8:6.9.10.23+dfsg-2.1+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1027164 1030767
Changes:
 imagemagick (8:6.9.10.23+dfsg-2.1+deb10u2) buster-security; urgency=high
 .
   [ Roberto C. Sánchez ]
   * Non-maintainer upload by the LTS Team.
   * Fix CVE-2020-19667: Stack-based buffer overflow and unconditional jump in
     ReadXPMImage in coders/xpm.c
   * Fix CVE-2020-25665: An out-of-bounds read in the PALM image coder in
     WritePALMImage in coders/palm.c
   * Fix CVE-2020-25666: Integer overflow is possible during simple math
     calculations in HistogramCompare() in MagickCore/histogram.c
   * Fix CVE-2020-25674: A for loop with an improper exit condition that can
     allow an out-of-bounds READ via heap-buffer-overflow in WriteOnePNGImage
     from coders/png.c
   * Fix CVE-2020-25675: Undefined behavior in the form of integer overflow and
     out-of-range values as a result of rounding calculations performed on
     unconstrained pixel offsets in the CropImage() and CropImageToTiles()
     routines of MagickCore/transform.c
   * Fix CVE-2020-25676: Undefined behavior in the form of integer overflow and
     out-of-range values as a result of rounding calculations performed on
     unconstrained pixel offsets in CatromWeights(), MeshInterpolate(),
     InterpolatePixelChannel(), InterpolatePixelChannels(), and
     InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c
   * Fix CVE-2020-27560: Division by Zero in OptimizeLayerFrames in
     MagickCore/layer.c, which may cause a denial of service
   * Fix CVE-2020-27750: Division by Zero in MagickCore/colorspace-private.h
     and MagickCore/quantum.h, which may cause a denial of service
   * Fix CVE-2020-27751: Undefined behavior in the form of values outside the
     range of type `unsigned long long` as well as a shift exponent that is too
     large for 64-bit type in MagickCore/quantum-export.c
   * Fix CVE-2020-27754: In IntensityCompare() of /magick/quantize.c, there are
     calls to PixelPacketIntensity() which could return overflowed values
   * Fix CVE-2020-27756: In ParseMetaGeometry() of MagickCore/geometry.c, image
     height and width calculations can lead to divide-by-zero conditions which
     also lead to undefined behavior
   * Fix CVE-2020-27757: A floating point math calculation in
     ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to
     undefined behavior in the form of a value outside the range of type
     unsigned long long
   * Fix CVE-2020-27758: Undefined behavior in the form of values outside the
     range of type `unsigned long long` in coders/txt.c
   * Fix CVE-2020-27759: In IntensityCompare() of /MagickCore/quantize.c, a
     double value was being casted to int and returned, which in some cases
     caused a value outside the range of type `int` to be returned
   * Fix CVE-2020-27760: In `GammaImage()` of /MagickCore/enhance.c, depending
     on the `gamma` value, it's possible to trigger a divide-by-zero condition
     when a crafted input file is processed
   * Fix CVE-2020-27761: WritePALMImage() in /coders/palm.c used size_t casts
     in several areas of a calculation which could lead to values outside the
     range of representable type `unsigned long` undefined behavior when a
     crafted input file was processed
   * Fix CVE-2020-27762: Undefined behavior in the form of values outside the
     range of type `unsigned char` in coders/hdr.c
   * Fix CVE-2020-27763: Undefined behavior in the form of math division by
     zero in MagickCore/resize.c
   * Fix CVE-2020-27764, CVE-2020-27776: Out-of-range values under some
     circumstances when a crafted input file is processed in
     /MagickCore/statistic.c
   * Fix CVE-2020-27765: Undefined behavior in the form of math division by
     zero in MagickCore/segment.c when a crafted file is processed
   * Fix CVE-2020-27774, CVE-2020-27766: Undefined behavior in the form of
     values outside the range of type `unsigned long` and a too large shift for
     64-bit type `ssize_t` in MagickCore/statistic.c
   * Fix CVE-2020-27767: Undefined behavior in the form of values outside the
     range of types `float` and `unsigned char` in MagickCore/quantum.h
   * Fix CVE-2020-27768: An outside the range of representable values of type
     `unsigned int` in MagickCore/quantum-private.h
   * Fix CVE-2020-27769: An outside the range of representable values of type
     `float` in MagickCore/quantize.c
   * Fix CVE-2020-27770: Due to a missing check for 0 value of
     `replace_extent`, it is possible for offset `p` to overflow in
     SubstituteString()
   * Fix CVE-2020-27771: In RestoreMSCWarning() of /coders/pdf.c there are
     several areas where calls to GetPixelIndex() could result in values
     outside the range of representable for the `unsigned char` type
   * Fix CVE-2020-27772: Undefined behavior in the form of values outside the
     range of type `unsigned int` in coders/bmp.c
   * Fix CVE-2020-27773: Undefined behavior in the form of values outside the
     range of type `unsigned char` or division by zero
   * Fix CVE-2020-27775: Undefined behavior in the form of values outside the
     range of type `unsigned char` in MagickCore/quantum.h
   * Fix CVE-2020-29599: ImageMagick mishandles the -authenticate option, which
     allows setting a password for password-protected PDF files. The
     user-controlled password was not properly escaped/sanitized and it was
     therefore possible to inject additional shell commands via
     coders/pdf.c.
   * Fix CVE-2021-3596: A NULL pointer dereference flaw in ReadSVGImage() in
     coders/svg.c
 .
   [ Bastien Roucariès ]
   * Fix CVE-2021-3574: executing a crafted TIFF file with the convert command,
     ASAN detects memory leaks. (Closes: #1027164)
   * Fix CVE-2021-20224: An integer overflow issue was discovered in ImageMagick's
     ExportIndexQuantum() function in MagickCore/quantum-export.c.
     Function calls could result in values outside the range of
     representable for the 'unsigned char'.
     When ImageMagick processes a crafted pdf file, this could
     lead to an undefined behaviour or a crash.
   * Mitigate CVE-2022-44267, CVE-2022-44268 by hardening policy.xml.
     Forbid reading /etc directory.
   * CVE-2022-44268, CVE-2022-44267: do not leak profiles.
     (Closes: #1030767)
Checksums-Sha1:
 9880bf3cb726ffd14527fd4861e5b4e17161cba9 5187 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc
 c0f3b6edd4930d8d0d19c74a7a8f57020dd498c7 249248 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz
 4a15f31624e6be93dbd31f54ce8630aee0ea4c26 11436 imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo
Checksums-Sha256:
 8344a42815133862ce39e9959225d4dcbb0ced96c3016e4ddf53ae436607f269 5187 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc
 2fe292cd08ba1a342dea8a9a1f1fc5a4493c97c025484238a805bb1790051758 249248 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz
 d193480556784b4b718254936177e68711e9cbabd1da46056d8095eed464630b 11436 imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo
Files:
 806a745ce1695e213f84d4ee4198ac09 5187 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc
 154d74af92f11b38899182dab22bf8d6 249248 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz
 7bae00e60f28fcdf22991076b8df24a7 11436 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmQMpOsRHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF9GxQ/+N5858tXKM5QOAO5h/2Vs7icfhQzbEDBR
KfjSPRTVY+Oa7QQy8WUBX1xZnMarITl1o5D99vtGg2Wg1z0DY9lm+U9dpKK2R4+a
RBxN2xZXvTLk6ZLmpkBWuBa5KgGdO4b/G8YseARWHV1SFQUHv7I2zl5+82Hlb3nZ
RzZ8sHSdQCMPMVoufORonzGd7YNrJEuNCvDzkoROJK0zV9N4+9C/O3T0oA1A1W0E
9PxBaMBvkVVx+jF6IcUgD9QPCHOdu457DQiQtUM97XkuqhK34pOQoaNfriH1E4kw
AxPIn2VdPQaP63BlvBswMTz8AX6nSyO8p0UvXy2ta8o3XHinBGtoftvdOpdWoUkF
vUFxVZ8SUJBmnJrErwlxMrdlXvPa5f0lBCe6BhSBmtN50fV/rmsj4NV+JFjXuVVn
aEmef9u1kMWpxYuuaiUM2eUO0gedRL1QV1jACJ+YDcog9d5tcP7EgCgO2OKkrlj2
adAvE84ZHd5acuWOpM5s8sGofl2hxwiM5iYC4KI1S0ikWZ0t+9IU7MZ+wffQzAD6
q3TcZe+yhxWjfLWSr5sTsOwbiU3zJC6XSb1K1woKdyu3A5fjo+UlBheCYZ7r6b/g
VIt+VGKzyXG0hISFc4ZZ6okmyz3UhyipDsNmG98GcLLDjhDHUFo2uxHzGuVL8AEP
z/6x6AA89NM=
=IvHY
-----END PGP SIGNATURE-----