Bug 643560 (CVE-2017-17879, CVE-2017-17914) – <media-gfx/imagemagick-{6.9.9.31,7.0.7.19}: multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2018-01-05 15:20:25 UTC]

CVE-2017-17879 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17879):
  In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer
  over-read in ReadOneMNGImage in coders/png.c, related to length calculation
  and caused by an off-by-one error.

CVE-2017-17914 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17914):
  In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function
  ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of
  service (ReadOneMNGImage large loop) via a crafted mng image file.

[Comment 1 Thomas Deutschmann (RETIRED) 2018-01-05 15:30:51 UTC]

@ Arches,

please test and mark stable:

  =media-gfx/imagemagick-6.9.9.31
  =media-gfx/imagemagick-7.0.7.19

[Comment 2 Thomas Deutschmann (RETIRED) 2018-01-06 05:26:04 UTC]

x86 stable

[Comment 3 Sergei Trofimovich (RETIRED) 2018-01-06 11:42:44 UTC]

sparc stable (thanks to Rolf Eike Beer)

[Comment 4 Agostino Sarubbo 2018-01-06 17:54:18 UTC]

amd64 stable

[Comment 5 Sergei Trofimovich (RETIRED) 2018-01-06 21:35:27 UTC]

ppc/ppc64 stable

[Comment 6 Sergei Trofimovich (RETIRED) 2018-01-06 22:32:10 UTC]

ia64 stable

[Comment 7 Markus Meier 2018-01-07 20:53:02 UTC]

arm stable

[Comment 8 Sergei Trofimovich (RETIRED) 2018-01-09 07:52:06 UTC]

hppa stable (thanks to Rolf Eike Beer)

[Comment 9 Tobias Klausmann (RETIRED) 2018-01-20 18:49:08 UTC]

Stable on alpha.

[Comment 10 Aaron Bauman (RETIRED) 2018-01-20 19:41:00 UTC]

All arches stable.

@maintainer(s), please clean the vulnerable versions from the tree:

GLSA Vote: No

=media-gfx/imagemagick-6.9.9.23
=media-gfx/imagemagick-6.9.9.26

=media-gfx/imagemagick-7.0.7.11
=media-gfx/imagemagick-7.0.7.14

[Comment 11 Thomas Deutschmann (RETIRED) 2018-04-21 19:17:23 UTC]

Cleaned up, repository is clean, all done.