Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2ce9ed0c by Sylvain Beucler at 2020-12-07T12:33:18+01:00
imagemagick: more stretch triage + clarifications
CVE-2020-27752
CVE-2020-25674
CVE-2020-25665
CVE-2020-25664
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -7189,10 +7189,9 @@ CVE-2020-27753
CVE-2020-27752
RESERVED
- imagemagick 8:6.9.11.24+dfsg-1
- [stretch] - imagemagick <postponed> (Minor issue, can be fixed with
later issues)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/1752
NOTE: ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/a9d563d3d73874312080d30dc4ba07cecad56192
- NOTE: ImageMagick6:
https://github.com/ImageMagick/ImageMagick6/commit/27d3ddedb73f63fa984ff5b4d66e07eef654070f
+ NOTE: ImageMagick6 commit provided by upstream pre-dates the vulnerable
version and is the same as CVE-2020-25664, clarification on-going
CVE-2020-27751
RESERVED
- imagemagick 8:6.9.11.24+dfsg-1
@@ -12304,7 +12303,7 @@ CVE-2020-25675
CVE-2020-25674
RESERVED
- imagemagick 8:6.9.11.24+dfsg-1
- [stretch] - imagemagick <postponed> (Minor issue, can be fixed with
later issues)
+ [stretch] - imagemagick <postponed> (Minor issue, read heap overflow)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/1715
NOTE: ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/67b871032183a29d3ca0553db6ce1ae80fddb9aa
NOTE: ImageMagick6:
https://github.com/ImageMagick/ImageMagick6/commit/2fdff8e040cd4401498d89f3c3d1f89cffd118b0
@@ -12355,18 +12354,17 @@ CVE-2020-25665
RESERVED
- imagemagick 8:6.9.11.24+dfsg-1
[buster] - imagemagick <ignored> (Minor issue)
- [stretch] - imagemagick <ignored> (Minor issue)
+ [stretch] - imagemagick <postponed> (Minor issue, read heap overflow)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/1714
NOTE: ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/cfd829bd3581b092e0a267b3deba46fa90b9bc88
NOTE: ImageMagick6:
https://github.com/ImageMagick/ImageMagick6/commit/ca80e93cc887fb8971ceba2eead2c74e2b927df4
CVE-2020-25664
RESERVED
- imagemagick 8:6.9.11.24+dfsg-1
- [stretch] - imagemagick <postponed> (Minor issue, can be fixed with
later issues)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/1716
NOTE: ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/1f450bb5ba53d275de6d1cd086c98a0b549ad393
NOTE: ImageMagick6:
https://github.com/ImageMagick/ImageMagick6/commit/27d3ddedb73f63fa984ff5b4d66e07eef654070f
- NOTE: reverted with CVE-2020-27752
+ NOTE: possible incomplete fix, cf. CVE-2020-27752 that applies after
the fix
CVE-2020-25663
RESERVED
- imagemagick <not-affected> (Vulnerable code introduced in 7.x)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ce9ed0c1f015c70e67ed440183de25369d2dc68
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ce9ed0c1f015c70e67ed440183de25369d2dc68
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
