908082 – (CVE-2023-2157, CVE-2023-34151, CVE-2023-34153) <media-gfx/imagemagick-{6.9.12.88,7.1.1.11}: multiple vulnerabilities

Bug 908082 (CVE-2023-2157, CVE-2023-34151, CVE-2023-34153) - <media-gfx/imagemagick-{6.9.12.88,7.1.1.11}: multiple vulnerabilities

Summary: <media-gfx/imagemagick-{6.9.12.88,7.1.1.11}: multiple vulnerabilities

Status:	IN_PROGRESS

Alias:	CVE-2023-2157, CVE-2023-34151, CVE-2023-34153

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal major (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B1 [glsa]
Keywords:

Depends on:	907992 907993
Blocks:
	Show dependency tree

Reported:	2023-06-09 03:57 UTC by John Helmert III
Modified:	2024-01-06 09:45 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2023-06-09 03:57:03 UTC

CVE-2023-2157 (https://bugzilla.redhat.com/show_bug.cgi?id=2208537):

A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.

Patch in 7.1.1-7: https://github.com/ImageMagick/ImageMagick/commit/9a9896fce95d09e5e47b86baccbe1ce1a2fca76b

Is there a fix in 6.x?

CVE-2023-34151 (https://github.com/ImageMagick/ImageMagick/issues/6341):

A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).

Fix in 6.9.12-88: https://github.com/ImageMagick/ImageMagick6/commit/133089f716f23ce0b80d89ccc1fd680960235512
Fix in 7.1.1-10: https://github.com/ImageMagick/ImageMagick/commit/3d6d98d8a2be30d74172ab43b5b8e874d2deb158

CVE-2023-34152 (https://github.com/ImageMagick/ImageMagick/issues/6339):

A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.

Apparently upstream thinks this is invalid, so keeping it off the CVE list.

CVE-2023-34153 (https://github.com/ImageMagick/ImageMagick/issues/6338):

A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.

Fix in 7.1.1-10: https://github.com/ImageMagick/ImageMagick/commit/d31c80d15a2c82fc1dd8e889e0f97b0219079a57

Is there a fix in 6.x?

Comment 1 John Helmert III archtester

2023-06-12 04:41:28 UTC

Are there fixes for CVE-2023-2157 and CVE-2023-34153 in 6.x?

Comment 2 Sam James archtester

2023-06-12 04:45:05 UTC

(In reply to John Helmert III from comment #1)
> Are there fixes for CVE-2023-2157 and CVE-2023-34153 in 6.x?

CVE-2023-2157:
- https://github.com/ImageMagick/ImageMagick6/commit/7e4c992f148afc5b28111e540921d5b6e4e38673 (note that jxc isn't supported in IM6)

CVE-2023-34153:
not sure, need to inspect the IM7 changes (https://github.com/ImageMagick/ImageMagick/commit/d31c80d15a2c82fc1dd8e889e0f97b0219079a57) and compare the relevant files

Comment 3 John Helmert III archtester

2023-06-12 04:47:18 UTC

Thanks!

Comment 4 Sam James archtester

2024-01-05 05:36:10 UTC

commit 2093f1a80afe379b2f1e5eeee9c125dc26a21b59
Author: Sam James <sam@gentoo.org>
Date:   Thu Dec 28 04:34:07 2023 +0000

    media-gfx/imagemagick: drop versions

    Signed-off-by: Sam James <sam@gentoo.org>