According to the RedHat summary [1]: An out-of-bounds read vulnerability in CopyMagickMemory was found that can lead to memory leak because the read data are written into output image using SetImageProperty or can cause DoS by crashing the application. Fixed by upstream as in [2], in version 6.9.5-4. The first version available in gentoo above that is 6.9.5-5, still keyworded as unstable. [1] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6491 [2] https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b Reproducible: Always
Verified the source of media-gfx/imagemagick-6.9.5.10, which does contain the appropriate fix.
This issue was resolved and addressed in GLSA 201611-21 at https://security.gentoo.org/glsa/201611-21 by GLSA coordinator Aaron Bauman (b-man).