Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 581958 (CVE-2016-5240, CVE-2016-5241)

Summary: <media-gfx/graphicsmagick-1.3.24: DoS
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: graphics+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [noglsa cve]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2016-05-03 09:23:40 UTC
From ${URL} :

We recently tested GraphicsMagick with our tool and found two issues that
causes DoS:

* Infinite loop caused by converting a circularly defined svg file.

* Arithmetic exception converting a svg file caused by a X%0 operation in

    (long) (y-fill_pattern->tile_info.y) % fill_pattern->rows,

Reproducers for both issues are attached. They are triggered by converting
a svg to another format. Identification is not affected.
These issues affect 1.3.18 and 1.3.23. Most likely other versions are
vulnerable too.

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-29 20:22:53 UTC
v1.3.24 which fixed the reported issues hit Gentoo repository via

=media-gfx/graphicsmagick-1.3.25 is the current stable version in the repository. No vulnerable version left. 

@ Security: Please vote!
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-12-01 07:53:01 UTC
Code fixing the issue:

Additional details:

As previously noted by Whissi the fixed code was introduced to the tree in 1.3.24.

GLSA Vote: No
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-09 23:34:46 UTC
*** Bug 582236 has been marked as a duplicate of this bug. ***