Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 186030 - media-gfx/imagemagick < 6.3.5.9: Multiple vulnerabilities (CVE-2007-498{5,6,7,8})
Summary: media-gfx/imagemagick < 6.3.5.9: Multiple vulnerabilities (CVE-2007-498{5,6,7...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: http://labs.idefense.com/intelligence...
Whiteboard: A2 [glsa]
Keywords:
Depends on: 193737
Blocks: 191001
  Show dependency tree
 
Reported: 2007-07-20 21:26 UTC by Hans de Graaff
Modified: 2020-04-02 21:47 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Ebuild for imagemagick 6.3.5-9 (imagemagick-6.3.5.9.ebuild,2.95 KB, text/plain)
2007-09-16 08:03 UTC, Hans de Graaff
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Hans de Graaff gentoo-dev 2007-07-20 21:26:44 UTC
imagemagick 6.3.5 has been released on July 5th, with a -2 patch version on the 17th. The reason I am mentioning it is that I got a huge memory leak when using imagemagick 6.3.4 through rmagick 1.15.7-r1. Both imagemagick 6.3.3 and 6.3.5 don't have this problem. 

Since things work again with imagemagick 6.3.5 I'm not going to hunt for the actual cause, but let me know if you need more information.
Comment 2 Hans de Graaff gentoo-dev 2007-09-16 08:03:32 UTC
Created attachment 131031 [details]
Ebuild for imagemagick 6.3.5-9

An updated ebuild for imagemagick-6.3.5-9.
Comment 3 Petteri Räty (RETIRED) gentoo-dev 2007-09-20 22:32:42 UTC
(In reply to comment #2)
> Created an attachment (id=131031) [edit]
> Ebuild for imagemagick 6.3.5-9
> 
> An updated ebuild for imagemagick-6.3.5-9.
> 

Couple months gone by since the original report so you could as well go ahead and do the bump yourself.
Comment 4 Christian Hoffmann (RETIRED) gentoo-dev 2007-09-21 19:55:55 UTC
Just saw the advisories about CVE-2007-4985 [1], CVE-2007-4986 [2], CVE-2007-4987 [3] and CVE-2007-4988 [4] from iDefense, so transforming this one to a security bug.

[1] http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=596
[2] http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=594
[3] http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=595
[4] http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=597
Comment 5 Robert Buchholz (RETIRED) gentoo-dev 2007-09-21 20:06:12 UTC
Setting whiteboard to A2 because the application itself is not actively remotely exploitable. A combination with networked applications makes this bug more serious though.
graphics, please provide an updated ebuild.
Comment 6 Hans de Graaff gentoo-dev 2007-09-21 20:22:26 UTC
I've added the ebuild for imagemagick 6.3.5-9 to CVS just now, as discussed on IRC with the graphics herd.
Comment 7 Tobias Heinlein (RETIRED) gentoo-dev 2007-09-21 20:40:50 UTC
Thanks. Arches, please stabilize media-gfx/imagemagick-6.3.5.9, target keywords are: "alpha amd64 hppa ia64 mips ppc ppc64 sparc x86 ~x86-fbsd".
Comment 8 Christian Faulhammer (RETIRED) gentoo-dev 2007-09-21 23:22:55 UTC
x86 stable
Comment 9 Ferris McCormick (RETIRED) gentoo-dev 2007-09-21 23:39:31 UTC
Sparc stable.
Comment 10 Jeroen Roovers gentoo-dev 2007-09-22 05:44:15 UTC
Stable for HPPA.
Comment 11 Jonas Pedersen 2007-09-22 09:55:03 UTC
media-gfx/imagemagick-6.3.5.9  USE="X jpeg mpeg perl png tiff truetype xml zlib -bzip2 -doc -fpx -graphviz -gs -hdri -jbig -jpeg2k -lcms -nocxx -openexr -q32 -q8 -wmf"

1. Emerges on AMD64. 
2. No collisions etc. 
3. Works - have tried to convert images with convert tool. 

Portage 2.1.2.12 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.5-r4, 2.6.22-gentoo-r2 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r2 x86_64 Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz
Gentoo Base System release 1.12.9
Timestamp of tree: Wed, 19 Sep 2007 21:50:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.21
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache collision-protect distcc distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict test"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/ http://trumpetti.atm.tut.fi/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo http://ds.thn.htu.se/linux/gentoo"
LC_ALL="en_DK.utf8"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/php-testing /usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi aiglx alsa amd64 apache2 arts atk berkdb bitmap-fonts cairo cdr cli cracklib crypt cups dbus dga directfb dri dts dvd dvdr dvdread eds emboss encode evo fam fbcn ffmpeg firefox fortran ftp gd gdbm gif gphoto2 gpm gstreamer gtk hal iconv icq ieee1394 ipv6 isdnlog java jpeg kde kerberos lm_sensors mad midi mikmod mjpeg mmx mozilla mp2 mp3 mpeg mplayer msn mudflap ncurses nls nptl nptlonly ogg oggvorbis opengl openmp pam pcre pda pdf perl png ppds pppd python qt qt3 qt3support qt4 quicktime readline reflection samba sdl session spell spl sse sse2 sse3 ssl svg tcpd test threads tiff truetype truetype-fonts type1-fonts unicode vorbis x264 xcomposite xml xorg xscreensaver xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="radeon"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Comment 12 Brent Baude (RETIRED) gentoo-dev 2007-09-22 14:10:35 UTC
ppc64 stable
Comment 13 Tobias Scherbaum (RETIRED) gentoo-dev 2007-09-22 14:40:34 UTC
  22 Sep 2007; Luca Barbato <lu_zero@gentoo.org> imagemagick-6.3.5.9.ebuild:
  Marked ppc

Comment 14 Raúl Porcel (RETIRED) gentoo-dev 2007-09-22 15:06:39 UTC
alpha/ia64 stable
Comment 15 Markus Rothe (RETIRED) gentoo-dev 2007-09-22 15:22:44 UTC
removing ppc64 as ranger marked stable (comment #12)
Comment 16 Chris Gianelloni (RETIRED) gentoo-dev 2007-09-22 16:45:04 UTC
amd64 done
Comment 17 Tobias Heinlein (RETIRED) gentoo-dev 2007-09-22 19:54:40 UTC
Last supported arch, ready for GLSA.
Comment 18 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-09-24 08:50:30 UTC
glsa request filed.
Comment 19 Jakub Moc (RETIRED) gentoo-dev 2007-09-26 14:17:17 UTC
The thing is broken, see Bug 193737. We need this bumped to 6.3.5.10
Comment 20 Sune Kloppenborg Jeppesen gentoo-dev 2007-09-26 15:59:44 UTC
Seems like a regression so yes we need fixed ebuild.
Comment 21 Hans de Graaff gentoo-dev 2007-09-27 16:52:40 UTC
imagemagick 6.3.5.10 is now in CVS and I got confirmation that it fixes the issues in bug 193737
Comment 22 Robert Buchholz (RETIRED) gentoo-dev 2007-09-27 18:24:50 UTC
Re-cc'ing arches. There was a regression in media-gfx/imagemagick-6.3.5.9, please stabilize 6.3.5.10. See comments 19 to 21 for details.

Targets are still: "alpha amd64 hppa ia64 mips ppc ppc64 sparc x86"
Comment 23 Brent Baude (RETIRED) gentoo-dev 2007-09-27 23:50:31 UTC
ppc64 stable thanks
Comment 24 Joshua Kinard gentoo-dev 2007-09-28 00:18:44 UTC
mips stable.
Comment 25 Ferris McCormick (RETIRED) gentoo-dev 2007-09-28 12:06:41 UTC
Sparc stable for 6.3.5.10
Comment 26 Raúl Porcel (RETIRED) gentoo-dev 2007-09-28 17:56:07 UTC
alpha/ia64/x86 stable, removing bsd since they have nothing to do
Comment 27 Tobias Scherbaum (RETIRED) gentoo-dev 2007-09-28 19:12:32 UTC
ppc stable
Comment 28 Wulf Krueger (RETIRED) gentoo-dev 2007-09-28 20:42:27 UTC
Marked stable on amd64.
Comment 29 Jeroen Roovers gentoo-dev 2007-09-29 15:58:56 UTC
Stable for HPPA. Oh, by the way:

# ChangeLog for dev-ruby/rmagick
...
*rmagick-1.15.10 (17 Sep 2007)

  17 Sep 2007; Hans de Graaff <graaff@gentoo.org> +rmagick-1.15.10.ebuild:
  Version bump, fixes compatibility issue with ImageMagick-6.3.5-9

I will consider stabilising rmagick for hppa before it's due.
Comment 30 Hans de Graaff gentoo-dev 2007-09-30 07:12:47 UTC
Thanks Jeroen. I've now filed a stablization request as bug 194246.
Comment 31 Robert Buchholz (RETIRED) gentoo-dev 2007-09-30 09:57:14 UTC
A2 -> GLSA request filed.
Comment 32 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2007-10-25 07:11:32 UTC
GLSA 200710-27, sorry for the delay
Comment 33 Christian Faulhammer (RETIRED) gentoo-dev 2007-10-25 07:15:35 UTC
I assume it should be closed
Comment 34 Christian Hoffmann (RETIRED) gentoo-dev 2007-11-18 11:11:46 UTC
mips, you've stabled the wrong version (6.3.5.9), I guess you want 6.3.5.10 stable to not cause any breakage (see comment #22).
Thanks to chithead who noticed that on #gentoo-security.