CVE-2017-17503 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17503): ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17502 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17502): ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17501 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17501): WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file. CVE-2017-17500 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17500): ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file. CVE-2017-17498 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17498): WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. CVE-2017-16669 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-16669): coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c.
@ Arches, please test and mark stable: =media-gfx/graphicsmagick-1.3.27
x86 stable
ppc/ppc64 stable
amd64 stable
ia64 stable
hppa stable
alpha stable
GLSA Vote: No Tree is clean.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=277876017fd01f5514400e4ecdad14775462d79e commit 277876017fd01f5514400e4ecdad14775462d79e Author: Aaron Bauman <bman@gentoo.org> AuthorDate: 2018-06-11 15:31:58 +0000 Commit: Aaron Bauman <bman@gentoo.org> CommitDate: 2018-06-11 15:33:00 +0000 media-gfx/graphicsmagick: drop vulnerable Bug: https://bugs.gentoo.org/640690 Package-Manager: Portage-2.3.40, Repoman-2.3.9 media-gfx/graphicsmagick/Manifest | 1 - .../graphicsmagick/graphicsmagick-1.3.26.ebuild | 134 --------------------- 2 files changed, 135 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af70f8a858e58bd0f1edddc06979d30048203718 commit af70f8a858e58bd0f1edddc06979d30048203718 Author: Rolf Eike Beer <eike@sf-mail.de> AuthorDate: 2018-07-10 18:50:20 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2018-07-10 19:10:27 +0000 media-gfx/graphicsmagick: stable 1.3.27 for sparc Bug: https://bugs.gentoo.org/640690 Package-Manager: Portage-2.3.40, Repoman-2.3.9 RepoMan-Options: --include-arches="sparc" media-gfx/graphicsmagick/graphicsmagick-1.3.27.ebuild | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
