Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 582236 - <media-gfx/graphicsmagick-1.3.24: SVG converting issue resulting in DoS
Summary: <media-gfx/graphicsmagick-1.3.24: SVG converting issue resulting in DoS
Status: RESOLVED DUPLICATE of bug 581958
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa?]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-06 08:44 UTC by Agostino Sarubbo
Modified: 2017-01-09 23:34 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-05-06 08:44:23 UTC 
From ${URL} :

A vulnerability was found in ImageMagick. Conversion of a circularly defined svg file could cause 
the application to go into infinite loop.

References:

http://seclists.org/oss-sec/2016/q2/182


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Hanno Böck gentoo-dev 2016-05-31 00:00:27 UTC 
6.9.4-5 and 7.0.1-7 have been released upstream and contain fixes related to this. Given the severity of these imagemagick issues I think we're handling them too slowly. Please bump asap and start stabilization.
Comment 2 Hanno Böck gentoo-dev 2016-05-31 00:01:45 UTC 
sorry about my latest comment, this belongs to another bug report (but I think this one will be also fixed by bumping to the latest version).
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2016-10-11 12:15:49 UTC 
magick/render.c is not present in media-gfx/imagemagick.  Reassigned under the proper package. The OSS mailing list has discrepancies regarding the proper package as well.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-09 23:34:46 UTC 

*** This bug has been marked as a duplicate of bug 581958 ***