Bug 682252 – <media-gfx/imagemagick-{6.9.11.0,7.0.8.36}: multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description D'juan McDonald (domhnall) 2019-04-01 17:21:18 UTC]

(https://nvd.nist.gov/vuln/detail/CVE-2019-10649):
In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.

ImageMagick 7.0.8-36 Q16 is vulnerable; other versions may also be affected.

upstream commit: https://github.com/ImageMagick/ImageMagick6/commit/e3417aebe17cbe274b7361aa92c83226ca5b646b

[Comment 1 D'juan McDonald (domhnall) 2019-04-01 18:52:23 UTC]

(https://nvd.nist.gov/vuln/detail/CVE-2019-10650):
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

Upstream Reference: https://github.com/ImageMagick/ImageMagick/issues/1532

[Comment 2 Sam James 2020-04-12 17:41:05 UTC]

Patch: https://github.com/ImageMagick/ImageMagick6/commit/e3417aebe17cbe274b7361aa92c83226ca5b646b

Patch: https://github.com/ImageMagick/ImageMagick/commit/d3ae9c19125c8704b4866381f7a064ca2cbdc006

Tree seems clean now. Tentatively setting to glsa? but it's a bit old.

[Comment 3 Yury German 2020-04-16 07:26:03 UTC]

GLSA Vote: No
Thank you all for you work. 
Closing as [noglsa].