Bug 506562 – <media-gfx/imagemagick-6.8.8.10: buffer overflow when handling PSD images ("L%06ld") (CVE-2014-2030)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-04-02 14:11:41 UTC]

From ${URL} :

A buffer overflow flaw affecting ImageMagick when creating PSD images was reported. The vulnerability is 
similar to CVE-2014-1947, except that CVE-2014-2030's format string is "L%06ld" instead of CVE-2014-1947's 
"L%02ld" due to commit r1448: http://trac.imagemagick.org/changeset/1448

Fixed by commit r13736: http://trac.imagemagick.org/changeset/13736


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Samuli Suominen (RETIRED) 2014-04-02 14:42:17 UTC]

Test and stabilize:

=media-gfx/imagemagick-6.8.8.10

[Comment 2 Jeroen Roovers (RETIRED) 2014-04-03 14:40:14 UTC]

Stable for HPPA.

[Comment 3 Agostino Sarubbo 2014-04-05 22:01:18 UTC]

amd64 stable

[Comment 4 Markus Meier 2014-04-07 19:43:06 UTC]

arm stable

[Comment 5 Agostino Sarubbo 2014-04-12 09:33:46 UTC]

x86 stable

[Comment 6 Agostino Sarubbo 2014-04-13 11:08:20 UTC]

ppc stable

[Comment 7 Agostino Sarubbo 2014-04-21 10:50:49 UTC]

alpha stable

[Comment 8 Agostino Sarubbo 2014-05-11 08:06:03 UTC]

ppc64 stable

[Comment 9 Agostino Sarubbo 2014-05-13 15:21:39 UTC]

ia64 stable

[Comment 10 Agostino Sarubbo 2014-05-14 16:11:44 UTC]

sparc stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 11 Yury German 2014-05-15 03:16:44 UTC]

Arches and Mainter(s), Thank you for your work.

Added to an existing GLSA request.

[Comment 12 GLSAMaker/CVETool Bot 2014-05-17 14:40:58 UTC]

This issue was resolved and addressed in
 GLSA 201405-09 at http://security.gentoo.org/glsa/glsa-201405-09.xml
by GLSA coordinator Chris Reffett (creffett).