Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 640692 (CVE-2017-17499, CVE-2017-17504)

Summary: <media-gfx/imagemagick-{6.9.9.26,7.0.7.14}: Multiple vulnerabilities
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: graphics+disabled
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [noglsa cve]
Package list:
=media-gfx/imagemagick-6.9.9.26 =media-gfx/imagemagick-7.0.7.14
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2017-12-11 14:48:19 UTC
CVE-2017-17504 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17504):
  ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile
  heap-based buffer over-read via a crafted file, related to ReadOneMNGImage.

CVE-2017-17499 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17499):
  ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in
  Magick::Image::read in Magick++/lib/Image.cpp.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-12-11 22:53:36 UTC
@ Arches,

please test and mark stable:

=media-gfx/imagemagick-6.9.9.26
=media-gfx/imagemagick-7.0.7.14
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2017-12-12 16:36:09 UTC
x86 stable
Comment 3 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-13 07:42:48 UTC
ppc/ppc64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2017-12-14 20:28:03 UTC
amd64 stable
Comment 5 Simon 2017-12-15 12:38:51 UTC
It seems that this change broke media-gfx/uniconvertor-2.0_pre379-r1 which is the current stable version. See https://bugs.gentoo.org/640668
Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-15 23:22:40 UTC
sparc stable (thanks to Rolf Eike Beer)
Comment 7 Markus Meier gentoo-dev 2017-12-21 19:27:27 UTC
arm stable
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-26 20:02:27 UTC
ia64 stable
Comment 9 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-29 00:25:25 UTC
hppa stable
Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev 2018-01-05 15:32:04 UTC
Superseded by bug 643560.
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2018-01-20 19:42:07 UTC
(In reply to Thomas Deutschmann from comment #10)
> Superseded by bug 643560.

Cleanup will be handled in bug #643560