Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 640692 (CVE-2017-17499, CVE-2017-17504) - <media-gfx/imagemagick-{6.9.9.26,7.0.7.14}: Multiple vulnerabilities
Summary: <media-gfx/imagemagick-{6.9.9.26,7.0.7.14}: Multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2017-17499, CVE-2017-17504
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-11 14:48 UTC by GLSAMaker/CVETool Bot
Modified: 2018-01-20 19:42 UTC (History)
1 user (show)

See Also:
Package list:
=media-gfx/imagemagick-6.9.9.26 =media-gfx/imagemagick-7.0.7.14
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-12-11 14:48:19 UTC 
CVE-2017-17504 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17504):
  ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile
  heap-based buffer over-read via a crafted file, related to ReadOneMNGImage.

CVE-2017-17499 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17499):
  ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in
  Magick::Image::read in Magick++/lib/Image.cpp.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-12-11 22:53:36 UTC 
@ Arches,

please test and mark stable:

=media-gfx/imagemagick-6.9.9.26
=media-gfx/imagemagick-7.0.7.14
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2017-12-12 16:36:09 UTC 
x86 stable
Comment 3 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-13 07:42:48 UTC 
ppc/ppc64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2017-12-14 20:28:03 UTC 
amd64 stable
Comment 5 Simon 2017-12-15 12:38:51 UTC 
It seems that this change broke media-gfx/uniconvertor-2.0_pre379-r1 which is the current stable version. See https://bugs.gentoo.org/640668
Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-15 23:22:40 UTC 
sparc stable (thanks to Rolf Eike Beer)
Comment 7 Markus Meier gentoo-dev 2017-12-21 19:27:27 UTC 
arm stable
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-26 20:02:27 UTC 
ia64 stable
Comment 9 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-29 00:25:25 UTC 
hppa stable
Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev 2018-01-05 15:32:04 UTC 
Superseded by bug 643560.
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2018-01-20 19:42:07 UTC 
(In reply to Thomas Deutschmann from comment #10)
> Superseded by bug 643560.

Cleanup will be handled in bug #643560